Homepage

Improper Authentication The advisory has been revoked - it doesn't affect any version of package wpa  (opens in a new tab)

Threat Intelligence

EPSS
1.18% (64th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-UBUNTU2510-WPA-15021975
  • published17 Jan 2026
  • disclosed22 Feb 2024
Report a new vulnerability Found a mistake?

Introduced: 22 Feb 2024

CVE-2023-52160  (opens in a new tab)
CWE-287  (opens in a new tab)

Amendment

The Ubuntu security team deemed this advisory irrelevant for Ubuntu:25.10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream wpa package and not the wpa package as distributed by Ubuntu.

The implementation of PEAP in wpa_supplicant through 2.10 allows authentication bypass. For a successful attack, wpa_supplicant must be configured to not verify the network's TLS certificate during Phase 1 authentication, and an eap_peap_decrypt vulnerability can then be abused to skip Phase 2 authentication. The attack vector is sending an EAP-TLV Success packet instead of starting Phase 2. This allows an adversary to impersonate Enterprise Wi-Fi networks.