Upstream information

CVE-2023-52161 at MITRE

Description

The Access Point functionality in eapol_auth_key_handle in eapol.c in iNet wireless daemon (IWD) before 2.14 allows attackers to gain unauthorized access to a protected Wi-Fi network. An attacker can complete the EAPOL handshake by skipping Msg2/4 and instead sending Msg4/4 with an all-zero key.

SUSE information

Overall state of this security issue: Does not affect SUSE products

This issue is currently rated as having important severity.

CVSS v3 Scores
  National Vulnerability Database SUSE
Base Score 7.5 7.5
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector Network Adjacent Network
Attack Complexity Low High
Privileges Required None None
User Interaction None None
Scope Unchanged Unchanged
Confidentiality Impact High High
Integrity Impact None High
Availability Impact None High
CVSSv3 Version 3.1 3.1
SUSE Bugzilla entry: 1219976 [NEW]

No SUSE Security Announcements cross referenced.

SUSE Timeline for this CVE

CVE page created: Thu Feb 15 17:11:46 2024
CVE page last modified: Mon Sep 9 21:32:10 2024