According to the versions of the wpa_supplicant package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    The implementation of PEAP in wpa_supplicant through 2.10 allows authentication bypass. For a successful     attack, wpa_supplicant must be configured to not verify the network's TLS certificate during Phase 1     authentication, and an eap_peap_decrypt vulnerability can then be abused to skip Phase 2 authentication.
    The attack vector is sending an EAP-TLV Success packet instead of starting Phase 2. This allows an     adversary to impersonate Enterprise Wi-Fi networks.(CVE-2023-52160)

Tenable has extracted the preceding description block directly from the EulerOS wpa_supplicant security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2024:0186 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2023-52160:
    The implementation of PEAP in wpa_supplicant through 2.10 allows authentication bypass. For a successful     attack, wpa_supplicant must be configured to not verify the network's TLS certificate during Phase 1     authentication, and an eap_peap_decrypt vulnerability can then be abused to skip Phase 2 authentication.
    The attack vector is sending an EAP-TLV Success packet instead of starting Phase 2. This allows an     adversary to impersonate Enterprise Wi-Fi networks.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 7.02, has wpa_supplicant packages installed that are affected by a vulnerability:

  - The implementation of PEAP in wpa_supplicant through 2.10 allows authentication bypass. For a successful     attack, wpa_supplicant must be configured to not verify the network's TLS certificate during Phase 1     authentication, and an eap_peap_decrypt vulnerability can then be abused to skip Phase 2 authentication.
    The attack vector is sending an EAP-TLV Success packet instead of starting Phase 2. This allows an     adversary to impersonate Enterprise Wi-Fi networks. (CVE-2023-52160)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-a95bdde55b advisory.

    backport fix for PEAP client (CVE-2023-52160)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3743 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3743-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                           Chris Lamb     February 27, 2024                             https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : wpa     Version        : 2:2.7+git20190128+0c1e29f-6+deb10u4     CVE ID         : CVE-2023-52160     Debian Bug     : 1064061

    It was discovered that there was a potential authentication bypass     vulnerability in wpa, a set of tools including the widely-used     wpasupplicant client for authenticating with WPA and WPA2 wireless     networks.

    For an attack to have been successful, wpasupplicant must have been     configured to not verify the network's TLS certificate during Phase 1     of the authentication cycle; a eap_peap_decrypt vulnerability could     have been used to skip Phase 2 authentication by sending an EAP-TLV     Success packet instead of starting Phase 2.

    For Debian 10 buster, this problem has been fixed in version     2:2.7+git20190128+0c1e29f-6+deb10u4.

    We recommend that you upgrade your wpa packages.

    For the detailed security status of wpa please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/wpa

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of wpa_supplicant installed on the remote host is prior to 2.6-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2480 advisory.

    wpa_supplicant: potential authorization bypass (CVE-2023-52160)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:2517 advisory.

    The wpa_supplicant packages contain an 802.1X Supplicant with support for WEP, WPA, WPA2 (IEEE 802.11i /     RSN), and various EAP authentication methods. They implement key negotiation with a WPA Authenticator for     client stations and controls the roaming and IEEE 802.11 authentication and association of the WLAN     driver.

    Security Fix(es):

    * wpa_supplicant: potential authorization bypass (CVE-2023-52160)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.4 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of wpa_supplicant installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-52160 advisory.

  - The implementation of PEAP in wpa_supplicant through 2.10 allows authentication bypass. For a successful     attack, wpa_supplicant must be configured to not verify the network's TLS certificate during Phase 1     authentication, and an eap_peap_decrypt vulnerability can then be abused to skip Phase 2 authentication.
    The attack vector is sending an EAP-TLV Success packet instead of starting Phase 2. This allows an     adversary to impersonate Enterprise Wi-Fi networks. (CVE-2023-52160)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
207614	EulerOS 2.0 SP8 : wpa_supplicant (EulerOS-SA-2024-2495)	Nessus	Huawei Local Security Checks	2024/9/24	2024/9/24	medium
236029	Alibaba Cloud Linux 3 : 0186: wpa_supplicant (ALINUX3-SA-2024:0186)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	medium
237988	NewStart CGSL MAIN 7.02 : wpa_supplicant Vulnerability (NS-SA-2025-0087)	Nessus	NewStart CGSL Local Security Checks	2025/6/9	2025/6/18	medium
191033	Fedora 39 : wpa_supplicant (2024-a95bdde55b)	Nessus	Fedora Local Security Checks	2024/2/27	2024/11/14	medium
191058	Debian dla-3743 : hostapd - security update	Nessus	Debian Local Security Checks	2024/2/27	2025/1/22	medium
191513	Amazon Linux 2 : wpa_supplicant (ALAS-2024-2480)	Nessus	Amazon Linux Local Security Checks	2024/3/5	2024/12/11	medium
194783	RHEL 9 : wpa_supplicant (RHSA-2024:2517)	Nessus	Red Hat Local Security Checks	2024/4/30	2024/11/7	medium
233068	CBL Mariner 2.0 Security Update: wpa_supplicant (CVE-2023-52160)	Nessus	MarinerOS Local Security Checks	2025/3/20	2025/3/20	medium

检测

插件搜索

medium

medium

medium

medium

medium

medium

medium

medium