Log in Start free

Vulnerability · Published Feb 22, 2024 · Assigned by mitre

CVE-2023-52161

High 7.5

In plain English

A high-severity improper authentication in the iwd package (Alpine). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.1%top 34.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

The Access Point functionality in eapol_auth_key_handle in eapol.c in iNet wireless daemon (IWD) before 2.14 allows attackers to gain unauthorized access to a protected Wi-Fi network. An attacker can complete the EAPOL handshake by skipping Msg2/4 and instead sending Msg4/4 with an all-zero key.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20iwd2.14-r0ALPINE-CVE-2023-52161
Alpine:v3.21iwd2.14-r0ALPINE-CVE-2023-52161
Alpine:v3.22iwd2.14-r0ALPINE-CVE-2023-52161
Alpine:v3.23iwd2.14-r0ALPINE-CVE-2023-52161
Alpine:v3.24iwd2.14-r0ALPINE-CVE-2023-52161
Debian:12iwd2.3-1+deb12u1DEBIAN-CVE-2023-52161
Debian:12iwd2.3-1+deb12u1DSA-5631-1
Debian:13iwd2.14-1DEBIAN-CVE-2023-52161
Debian:14iwd2.14-1DEBIAN-CVE-2023-52161
Ubuntu:22.04:LTSiwdno fix listedUBUNTU-CVE-2023-52161
Ubuntu:24.04:LTSiwdno fix listedUBUNTU-CVE-2023-52161

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References