Héloïse Gollier

The issue is related to the IEEE 802.11 standard, which sometimes enables an adversary to trick a victim into connecting to an unintended or untrusted network. This occurs because the SSID is not always used to derive the pairwise master key or session keys, and there is not a protected exchange of an SSID during a 4-way handshake. The problem affects all operating systems and Wi-Fi clients, including home and mesh networks based on WEP, WPA3, 802.11X/EAP, and AMPE protocols. An estimated number of potentially affected devices worldwide is not explicitly mentioned, but it is implied that the issue is widespread, affecting billions of devices. There is no information about real-world incidents where this issue was exploited. Technical details about exploitation include: - **API Endpoints:** Not specified - **Vulnerable Parameters or Variables:** `SSID` (network identifier) - **Function Names:** Not specified

The issue is related to the implementation of PEAP in wpa supplicant, which allows authentication bypass. For a successful attack, wpa supplicant must be configured to not verify the network's TLS certificate during Phase 1 authentication, and an eap peap decrypt vulnerability can then be abused to skip Phase 2 authentication. The attack vector is sending an EAP-TLV Success packet instead of starting Phase 2. This allows an adversary to impersonate Enterprise Wi-Fi networks. Up to 2.3 billion user devices may be exposed to this issue, including Android, Linux, and ChromeOS devices.