The implementation of PEAP in wpa_supplicant up to and including 2.10 allows authentication bypass. For a successful attack, wpa_supplicant must be configured to not verify the network's TLS certificate during Phase 1 authentication, and an eap_peap_decrypt vulnerability can then be abused to skip Phase 2 authentication. The attack vector is sending an EAP-TLV Success packet instead of starting Phase 2. This allows an adversary to impersonate Enterprise Wi-Fi networks.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
w1.fi wpa_supplicant |
||
debian debian linux 10.0 |
||
redhat enterprise linux 8.0 |
||
redhat enterprise linux 9.0 |
||
fedoraproject fedora 39 |
Vulmon