Vulnerability Details : CVE-2023-52160
Potential exploit
The implementation of PEAP in wpa_supplicant through 2.10 allows authentication bypass. For a successful attack, wpa_supplicant must be configured to not verify the network's TLS certificate during Phase 1 authentication, and an eap_peap_decrypt vulnerability can then be abused to skip Phase 2 authentication. The attack vector is sending an EAP-TLV Success packet instead of starting Phase 2. This allows an adversary to impersonate Enterprise Wi-Fi networks.
Products affected by CVE-2023-52160
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
- cpe:2.3:a:w1.fi:wpa_supplicant:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2023-52160
1.20%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 78 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-52160
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.5
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |
2.8
|
3.6
|
134c704f-9b21-4f2e-91b3-4a467353bcc0 | 2024-08-27 |
|
6.5
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |
2.8
|
3.6
|
NIST | 2024-03-04 |
|
6.5
|
MEDIUM | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
N/A
|
N/A
|
RedHat-CVE-2023-52160 | 2024-02-16 |
CWE ids for CVE-2023-52160
-
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.Assigned by:
- 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)
- nvd@nist.gov (Primary)
References for CVE-2023-52160
-
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N46C4DTVUWK336OYDA4LGALSC5VVPTCC/
[SECURITY] Fedora 39 Update: wpa_supplicant-2.10-9.fc39 - package-announce - Fedora Mailing-ListsMailing List
-
https://w1.fi/cgit/hostap/commit/?id=8e6485a1bcb0baffdea9e55255a81270b768439c
hostap - hostapd/wpa_supplicantPatch
-
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QU6IR4KV3ZXJZLK2BY7HAHGZNCP7FPNI/
[SECURITY] Fedora 38 Update: wpa_supplicant-2.10-7.fc38 - package-announce - Fedora Mailing-ListsThird Party Advisory
-
https://www.top10vpn.com/research/wifi-vulnerabilities/
New WiFi Authentication Vulnerabilities DiscoveredThird Party Advisory
-
https://lists.debian.org/debian-lts-announce/2024/02/msg00013.html
[SECURITY] [DLA 3743-1] wpa security updateMailing List;Third Party Advisory
Jump to