CVE-2023-52160

CVSS 3.1 Score 6.5 of 10 (medium)

Details

Published Feb 22, 2024
Updated: Mar 10, 2024
CWE ID 287

Summary

CVE-2023-52160 is a vulnerability that affects the implementation of PEAP in wpa_supplicant up to version 2.10. This vulnerability allows for authentication bypass, enabling an attacker to impersonate Enterprise Wi-Fi networks. To exploit this vulnerability, the attacker must configure wpa_supplicant to not verify the network's TLS certificate during Phase 1 authentication and then abuse an eap_peap_decrypt vulnerability to skip Phase 2 authentication by sending an EAP-TLV Success packet. The potential danger of this vulnerability is high confidentiality impact, as an attacker could gain unauthorized access to sensitive information on the organization's network. Remediation involves updating wpa_supplicant to version 2.11 or later and configuring it to properly verify the network's TLS certificate during authentication processes.

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2023-52160 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options