CVE-2023-52424

Publication date 17 May 2024

Last updated 30 May 2025

Ubuntu priority

Cvss 3 Severity Score

The IEEE 802.11 standard sometimes enables an adversary to trick a victim into connecting to an unintended or untrusted network with Home WEP, Home WPA3 SAE-loop. Enterprise 802.1X/EAP, Mesh AMPE, or FILS, aka an “SSID Confusion” issue. This occurs because the SSID is not always used to derive the pairwise master key or session keys, and because there is not a protected exchange of an SSID during a 4-way handshake.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
wpa	25.04 plucky	Vulnerable, fix deferred
	24.10 oracular	Vulnerable, fix deferred
	24.04 LTS noble	Vulnerable, fix deferred
	23.10 mantic	Ignored end of life, was deferred [2024-11-13]
	22.04 LTS jammy	Vulnerable, fix deferred
	20.04 LTS focal	Vulnerable, fix deferred
	18.04 LTS bionic	Vulnerable, fix deferred
	16.04 LTS xenial	Vulnerable, fix deferred
	14.04 LTS trusty	Vulnerable, fix deferred

Notes

alexmurray

Since this is a vulnerability in the 802.11 standard it is assumed that the wpa package in Ubuntu (which is an implementation of this standard) is affected but at this time 2024-11-13 there does not appear to be an official update available from the project which resolves this vulnerability.

Severity score breakdown

Parameter	Value
Base score	7.4 · High
Attack vector	Adjacent
Attack complexity	Low
Privileges required	Low
User interaction	Required
Scope	Unchanged
Confidentiality	High
Integrity impact	High
Availability impact	High
Vector	CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H