CVE-2023-52424: wpa Missing Critical Step in Authentication
Vulnerability summary
CVE-2023-52424 is a high (CVSS 7.4) Missing Critical Step in Authentication vulnerability in wpa. EPSS estimates a 0.72% chance of exploitation in the next 30 days, higher than 53.1% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 17-05-2024PublishedVulnerability first disclosed.
- 13-02-2025Last modifiedVulnerability information updated.
Description
The IEEE 802.11 standard sometimes enables an adversary to trick a victim into connecting to an unintended or untrusted network with Home WEP, Home WPA3 SAE-loop. Enterprise 802.1X/EAP, Mesh AMPE, or FILS, aka an "SSID Confusion" issue. This occurs because the SSID is not always used to derive the pairwise master key or session keys, and because there is not a protected exchange of an SSID during a 4-way handshake.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.4HighCVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
- NVDNIST7.4HighCVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.72%
Chance of exploitation in the next 30 days
Percentile
53%
Versus all other CVEs
30-day change
0.00 pp
From 0.72% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Mageia2 products
- hostapd< 2.11-1.mga9
- wpa_supplicant< 2.11-1.mga9
Opensuse1 product
- wpa_supplicant&distro=openSUSE Tumbleweed< 2.11-1.1
Ubuntu1 product
- wpaAll versions (No fix recorded)
3 vendors · 4 products