CVE-2023-52160

A flaw was found in wpa_supplicant's implementation of PEAP. This issue may allow an attacker to skip the second phase of authentication when the target device has not been properly configured to verify the authentication server. By skipping the second phase of authentication, it’s easier for an attacker to create a rogue clone of a trusted WiFi network to trick the victim into connecting, all without knowing their password.

While the flaw in wpa_supplicant's implementation of PEAP authentication represents a concerning security vulnerability, its classification as a moderate severity issue is based on several factors. Firstly, the attack requires specific prerequisites, including knowledge of the target SSID and the misconfiguration of wpa_supplicant on the victim's device, which somewhat limits its widespread exploitation. Additionally, the attack vector primarily targets Enterprise networks relying on PEAP authentication, narrowing its impact compared to more widely used authentication methods. Furthermore, while the ability to bypass Phase-2 authentication poses a risk of unauthorized network access and potential data exposure, it does not directly compromise the confidentiality or integrity of sensitive information.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.