CVE-2023-52161 Auth bypass in n/a
Attackers can bypass Wi-Fi authentication in iNet wireless daemon by skipping handshake steps, gaining unauthorized network access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-52161?
CVE-2023-52161 is a high-severity authentication bypass vulnerability in n/a, published on 22 Feb 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Access Point functionality in eapol_auth_key_handle in eapol.c in iNet wireless daemon (IWD) before 2.14 allows attackers to gain unauthorized access to a protected Wi-Fi network. An attacker can complete the EAPOL handshake by skipping Msg2/4 and instead sending Msg4/4 with an all-zero key.
Weakness: CWE-287
Which versions are affected by CVE-2023-52161?
It affects 1 product.
Products include Intel Inet Wireless Daemon.
How do I fix CVE-2023-52161?
Upgrade to a fixed version.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2023-52161 being exploited?
There is no known exploitation of CVE-2023-52161 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as AZL-43933, AZL-44235, DEBIAN-CVE-2023-52161, DLA-3738-1, DSA-5631-1, GHSA-22f2-7248-9pxp and 1 more.