The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:0764-1 advisory.

    - CVE-2023-52160: Bypassing WiFi Authentication (bsc#1219975).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the wpa_supplicant package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    The implementation of PEAP in wpa_supplicant through 2.10 allows authentication bypass. For a successful     attack, wpa_supplicant must be configured to not verify the network's TLS certificate during Phase 1     authentication, and an eap_peap_decrypt vulnerability can then be abused to skip Phase 2 authentication.
    The attack vector is sending an EAP-TLV Success packet instead of starting Phase 2. This allows an     adversary to impersonate Enterprise Wi-Fi networks.(CVE-2023-52160)

Tenable has extracted the preceding description block directly from the EulerOS wpa_supplicant security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2024:0819-1 advisory.

    - CVE-2023-52160: Bypassing WiFi Authentication (bsc#1219975).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of wpa_supplicant installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-52160 advisory.

  - The implementation of PEAP in wpa_supplicant through 2.10 allows authentication bypass. For a successful     attack, wpa_supplicant must be configured to not verify the network's TLS certificate during Phase 1     authentication, and an eap_peap_decrypt vulnerability can then be abused to skip Phase 2 authentication.
    The attack vector is sending an EAP-TLV Success packet instead of starting Phase 2. This allows an     adversary to impersonate Enterprise Wi-Fi networks. (CVE-2023-52160)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 7.02, has wpa_supplicant packages installed that are affected by a vulnerability:

  - The implementation of PEAP in wpa_supplicant through 2.10 allows authentication bypass. For a successful     attack, wpa_supplicant must be configured to not verify the network's TLS certificate during Phase 1     authentication, and an eap_peap_decrypt vulnerability can then be abused to skip Phase 2 authentication.
    The attack vector is sending an EAP-TLV Success packet instead of starting Phase 2. This allows an     adversary to impersonate Enterprise Wi-Fi networks. (CVE-2023-52160)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2024-8014:01 advisory.

    * wpa_supplicant: potential authorization bypass (CVE-2023-52160)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The implementation of PEAP in wpa_supplicant through 2.10 allows authentication bypass. For a successful     attack, wpa_supplicant must be configured to not verify the network's TLS certificate during Phase 1     authentication, and an eap_peap_decrypt vulnerability can then be abused to skip Phase 2 authentication.
    The attack vector is sending an EAP-TLV Success packet instead of starting Phase 2. This allows an     adversary to impersonate Enterprise Wi-Fi networks. (CVE-2023-52160)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-a95bdde55b advisory.

    backport fix for PEAP client (CVE-2023-52160)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3743 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3743-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                           Chris Lamb     February 27, 2024                             https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : wpa     Version        : 2:2.7+git20190128+0c1e29f-6+deb10u4     CVE ID         : CVE-2023-52160     Debian Bug     : 1064061

    It was discovered that there was a potential authentication bypass     vulnerability in wpa, a set of tools including the widely-used     wpasupplicant client for authenticating with WPA and WPA2 wireless     networks.

    For an attack to have been successful, wpasupplicant must have been     configured to not verify the network's TLS certificate during Phase 1     of the authentication cycle; a eap_peap_decrypt vulnerability could     have been used to skip Phase 2 authentication by sending an EAP-TLV     Success packet instead of starting Phase 2.

    For Debian 10 buster, this problem has been fixed in version     2:2.7+git20190128+0c1e29f-6+deb10u4.

    We recommend that you upgrade your wpa packages.

    For the detailed security status of wpa please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/wpa

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of wpa_supplicant installed on the remote host is prior to 2.6-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2480 advisory.

    wpa_supplicant: potential authorization bypass (CVE-2023-52160)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:2517 advisory.

    The wpa_supplicant packages contain an 802.1X Supplicant with support for WEP, WPA, WPA2 (IEEE 802.11i /     RSN), and various EAP authentication methods. They implement key negotiation with a WPA Authenticator for     client stations and controls the roaming and IEEE 802.11 authentication and association of the WLAN     driver.

    Security Fix(es):

    * wpa_supplicant: potential authorization bypass (CVE-2023-52160)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.4 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of wpa_supplicant installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-52160 advisory.

  - The implementation of PEAP in wpa_supplicant through 2.10 allows authentication bypass. For a successful     attack, wpa_supplicant must be configured to not verify the network's TLS certificate during Phase 1     authentication, and an eap_peap_decrypt vulnerability can then be abused to skip Phase 2 authentication.
    The attack vector is sending an EAP-TLV Success packet instead of starting Phase 2. This allows an     adversary to impersonate Enterprise Wi-Fi networks. (CVE-2023-52160)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
191627	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : wpa_supplicant (SUSE-SU-2024:0764-1)	Nessus	SuSE Local Security Checks	2024/3/6	2026/6/26	medium
202972	EulerOS 2.0 SP8 : wpa_supplicant (EulerOS-SA-2024-2057)	Nessus	Huawei Local Security Checks	2024/7/22	2024/7/22	medium
191772	SUSE SLES15 Security Update : wpa_supplicant (SUSE-SU-2024:0819-1)	Nessus	SuSE Local Security Checks	2024/3/9	2026/6/25	medium
233072	Azure Linux 3.0 Security Update: wpa_supplicant (CVE-2023-52160)	Nessus	Azure Linux Local Security Checks	2025/3/20	2025/9/15	medium
242751	NewStart CGSL MAIN 7.02 : wpa_supplicant Vulnerability (NS-SA-2025-0181)	Nessus	NewStart CGSL Local Security Checks	2025/7/25	2025/7/25	medium
291986	MiracleLinux 9 : wpa_supplicant-2.10-5.el9 (AXSA:2024-8014:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	medium
226599	Linux Distros Unpatched Vulnerability : CVE-2023-52160	Nessus	Misc.	2025/3/5	2026/7/12	medium
191033	Fedora 39 : wpa_supplicant (2024-a95bdde55b)	Nessus	Fedora Local Security Checks	2024/2/27	2024/11/14	medium
191058	Debian dla-3743 : hostapd - security update	Nessus	Debian Local Security Checks	2024/2/27	2025/1/22	medium
191513	Amazon Linux 2 : wpa_supplicant (ALAS-2024-2480)	Nessus	Amazon Linux Local Security Checks	2024/3/5	2024/12/11	medium
194783	RHEL 9 : wpa_supplicant (RHSA-2024:2517)	Nessus	Red Hat Local Security Checks	2024/4/30	2024/11/7	medium
233068	CBL Mariner 2.0 Security Update: wpa_supplicant (CVE-2023-52160)	Nessus	MarinerOS Local Security Checks	2025/3/20	2025/3/20	medium

检测

插件搜索

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium