CVE-2023-52161

What it actually does

The flaw permits an attacker to bypass EAPOL authentication in the Access Point role by omitting Msg2/4 and supplying Msg4/4 containing an all-zero key, completing the four-way handshake and obtaining network access without valid credentials.

Why it matters to the business

Attackers can join otherwise protected Wi-Fi networks, exposing connected devices and traffic to interception or unauthorized use until the daemon is updated.

How an attack unfolds

An attacker positioned to observe or participate in the EAPOL exchange sends a crafted Msg4/4 with an all-zero key while skipping the expected Msg2/4 response, causing the daemon to accept the handshake and grant the attacker association to the protected network.

How to fix it

Upgrade iNet wireless daemon (IWD) to version 2.14 or later on all affected systems; until upgrades are complete, disable the Access Point functionality or isolate affected devices from untrusted networks.

How to confirm the fix worked

Confirm the installed IWD version is 2.14 or newer via package manager output or binary version string; re-test EAPOL handshake behavior with a compliant supplicant to verify Msg2/4 enforcement.

Typical attack path

1. Observe or initiate an EAPOL handshake with a target IWD Access Point
2. Omit transmission of Msg2/4
3. Transmit a forged Msg4/4 containing an all-zero encryption key
4. Complete association and obtain network access

How to detect it

Review wireless authentication logs and packet captures for EAPOL handshakes that complete without a Msg2/4 response or contain an all-zero key in Msg4/4; correlate with successful association events from the IWD daemon.

What your security team should do

• Prioritize upgrade of IWD to 2.14+ across all wireless access-point deployments within the next maintenance window
• Inventory systems running IWD and verify the Access Point role is not enabled on untrusted interfaces
• Monitor vendor advisories for any subsequent backports or configuration mitigations