CVE-2023-28720

What it actually does

Improper initialization in Intel PROSet/Wireless and Killer Wi-Fi software allows an adjacent unauthenticated attacker to trigger a denial-of-service condition that affects wireless connectivity.

Why it matters to the business

Wireless network connections on affected systems can be disrupted, causing temporary loss of network access and operational downtime for users or devices relying on Intel Wi-Fi adapters.

How an attack unfolds

An attacker positioned within wireless range sends specially crafted frames that exploit the initialization flaw, causing the Wi-Fi software to enter an unstable state and resulting in denial of service without requiring authentication or user interaction.

How to fix it

Update Intel PROSet/Wireless and Killer Wi-Fi software to version 22.240 or later on all affected systems. Apply vendor-supplied patches promptly and verify the installed driver and software versions after installation.

How to confirm the fix worked

Confirm the software version is 22.240 or newer via the Intel Driver & Support Assistant or Windows Programs and Features. Test wireless connectivity stability after applying updates and monitor for recurrence of service crashes.

Typical attack path

1. Attacker gains proximity to the target wireless network
2. Attacker transmits crafted 802.11 frames targeting the vulnerable initialization path
3. Software enters a faulted state leading to loss of wireless connectivity
4. Connectivity remains impaired until the affected process or system is restarted

How to detect it

Review system and application event logs for unexpected restarts or crashes of Intel wireless services or drivers. Correlate adjacent wireless activity with loss of connectivity events on affected hosts.

What your security team should do

• Prioritize deployment of version 22.240 or later across all endpoints using the affected Intel Wi-Fi software
• Enable automatic driver and software update mechanisms where feasible
• Include wireless adapter software in the regular vulnerability scanning and patch management process