CVE-2015-8023

What it actually does

The server implementation of the EAP-MSCHAPv2 protocol does not properly validate local state, allowing remote attackers to bypass authentication via an empty Success message in response to an initial Challenge message.

Why it matters to the business

Attackers could gain unauthorized network access through bypassed authentication in affected deployments, potentially exposing internal resources and increasing breach risk in environments relying on the vulnerable component.

How an attack unfolds

An attacker connects to a service using the vulnerable EAP-MSCHAPv2 implementation, receives an initial Challenge message, and replies with an empty Success message to bypass authentication checks and establish a session without valid credentials.

How to fix it

Upgrade the affected package to the fixed commit cd69a2a516e6503c1a1c7e097ee90d255ec3d6b7 and verify the update across all instances.

How to confirm the fix worked

Confirm the deployed version matches the fixed commit, retest EAP-MSCHAPv2 authentication flows to ensure state validation occurs, and review configuration for the updated component.

Typical attack path

1. Initiate EAP-MSCHAPv2 authentication exchange with the target server
2. Receive Challenge message from the server
3. Respond with crafted empty Success message
4. Bypass state validation and obtain authenticated session

How to detect it

Review authentication and protocol logs for sessions that complete after an empty or malformed Success response to a Challenge; correlate with network traffic showing EAP-MSCHAPv2 exchanges lacking proper state transitions.

What your security team should do

• Apply the commit fix to all instances of the affected package
• Audit authentication logs for anomalous successful sessions following Challenge messages
• Restrict exposure of EAP-MSCHAPv2 services to trusted networks until patched