Homepage

Improper Authorization The advisory has been revoked - it doesn't affect any version of package wpa_supplicant  (opens in a new tab)

Threat Intelligence

EPSS
1.18% (64th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL9-WPASUPPLICANT-12420108
  • published1 Sept 2025
  • disclosed16 Feb 2024
Report a new vulnerability Found a mistake?

Introduced: 16 Feb 2024

CVE-2023-52160  (opens in a new tab)
CWE-285  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:9.

NVD Description

Note: Versions mentioned in the description apply only to the upstream wpa_supplicant package and not the wpa_supplicant package as distributed by RHEL.

The implementation of PEAP in wpa_supplicant through 2.10 allows authentication bypass. For a successful attack, wpa_supplicant must be configured to not verify the network's TLS certificate during Phase 1 authentication, and an eap_peap_decrypt vulnerability can then be abused to skip Phase 2 authentication. The attack vector is sending an EAP-TLV Success packet instead of starting Phase 2. This allows an adversary to impersonate Enterprise Wi-Fi networks.