Logo
›
›vulnerability›CVE-2023-52160
Name
CVE-2023-52160
Source
NVD ( link)Debian ( link)
Description
The implementation of PEAP in wpa_supplicant through 2.10 allows authentication bypass. For a successful attack, wpa_supplicant must be configured to not verify the network's TLS certificate during Phase 1 authentication, and an eap_peap_decrypt vulnerability can then be abused to skip Phase 2 authentication. The attack vector is sending an EAP-TLV Success packet instead of starting Phase 2. This allows an adversary to impersonate Enterprise Wi-Fi networks.
CWEs
CWE-287 CWE-287
Published Date
Updated Date
Workaround
-
Advisories
https://lists.debian.org/debian-lts-announce/2024/02/msg00013.htmlMailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N46C4DTVUWK336OYDA4LGALSC5VVPTCC/Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QU6IR4KV3ZXJZLK2BY7HAHGZNCP7FPNI/Third Party Advisory
https://w1.fi/cgit/hostap/commit/?id=8e6485a1bcb0baffdea9e55255a81270b768439cPatch
https://www.top10vpn.com/research/wifi-vulnerabilities/Third Party Advisory
https://lists.debian.org/debian-lts-announce/2024/02/msg00013.htmlMailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N46C4DTVUWK336OYDA4LGALSC5VVPTCC/Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QU6IR4KV3ZXJZLK2BY7HAHGZNCP7FPNI/Third Party Advisory
https://w1.fi/cgit/hostap/commit/?id=8e6485a1bcb0baffdea9e55255a81270b768439cPatch
https://www.top10vpn.com/research/wifi-vulnerabilities/Third Party Advisory

Analysis#

Affected Component
Analysis
wpa-supplicant
Patched
hostapd
Patched

Vulnerability Ratings#

6.5
CVSSv31
6.5
CVSSv31
NaN
other

Others affected components#

Name
Project
Project Version
Version
Status
hostapd
buildroot
2025.02.x
2.11
Not Affected
wpa_supplicant
buildroot
2025.02.x
2.11
Not Affected
hostapd
buildroot
master
2.11
Not Affected
wpa_supplicant
buildroot
master
2.11
Not Affected
hostapd
openwrt
master
2026.04.02~b004de0bf1b54d669d358b7f33d6f474bd9719a6-r1
Not Affected
hs20
openwrt
master
2020.06.08~5a8b366233f5585e68a4ffbb604fbb4a848eb325-r10
Not Affected
hostapd
openwrt
openwrt-25.12
2025.08.26~ca266cc24d8705eb1a2a0857ad326e48b1408b20-r1
Not Affected
hs20
openwrt
openwrt-25.12
2020.06.08~5a8b366233f5585e68a4ffbb604fbb4a848eb325-r10
Not Affected
hostapd
yocto
kirkstone
2.10
Patched
wpa-supplicant
yocto
kirkstone
2.10
Patched
hostapd
yocto
master
2.11
Not Affected
wpa-supplicant
yocto
master
2.11
Not Affected

Resolved with patches#

hostapd (yocto:kirkstone)

#
Title
Author
Resolve
1
PEAP client: Update Phase 2 authentication requirements
Jouni Malinen <j@w1.fi>
CVE-2023-52160

wpa-supplicant (yocto:kirkstone)

#
Title
Author
Resolve
1
PEAP client: Update Phase 2 authentication requirements
Jouni Malinen <j@w1.fi>
CVE-2023-52160

hostapd (yocto:scarthgap)

#
Title
Author
Resolve
1
PEAP client: Update Phase 2 authentication requirements
Jouni Malinen <j@w1.fi>
CVE-2023-52160

wpa-supplicant (yocto:scarthgap)

#
Title
Author
Resolve
1
PEAP client: Update Phase 2 authentication requirements
Jouni Malinen <j@w1.fi>
CVE-2023-52160