The Access Point functionality in eapol_auth_key_handle in eapol.c in iNet wireless daemon (IWD) before 2.14 allows attackers to gain unauthorized access to a protected Wi-Fi network. An attacker can complete the EAPOL handshake by skipping Msg2/4 and instead sending Msg4/4 with an all-zero key.

The remote Fedora 40 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2024-58c59bfa4c advisory.

  - The Access Point functionality in eapol_auth_key_handle in eapol.c in iNet wireless daemon (IWD) before     2.14 allows attackers to gain unauthorized access to a protected Wi-Fi network. An attacker can complete     the EAPOL handshake by skipping Msg2/4 and instead sending Msg4/4 with an all-zero key. (CVE-2023-52161)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-3fa713f2e0 advisory.

  - The Access Point functionality in eapol_auth_key_handle in eapol.c in iNet wireless daemon (IWD) before     2.14 allows attackers to gain unauthorized access to a protected Wi-Fi network. An attacker can complete     the EAPOL handshake by skipping Msg2/4 and instead sending Msg4/4 with an all-zero key. (CVE-2023-52161)

  - p2putil.c in iNet wireless daemon (IWD) through 2.15 allows attackers to cause a denial of service (daemon     crash) or possibly have unspecified other impact because of initialization issues in situations where     parsing of advertised service information fails. (CVE-2024-28084)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-4ef5edfb2a advisory.

  - The Access Point functionality in eapol_auth_key_handle in eapol.c in iNet wireless daemon (IWD) before     2.14 allows attackers to gain unauthorized access to a protected Wi-Fi network. An attacker can complete     the EAPOL handshake by skipping Msg2/4 and instead sending Msg4/4 with an all-zero key. (CVE-2023-52161)

  - p2putil.c in iNet wireless daemon (IWD) through 2.15 allows attackers to cause a denial of service (daemon     crash) or possibly have unspecified other impact because of initialization issues in situations where     parsing of advertised service information fails. (CVE-2024-28084)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2024-fdce971b84 advisory.

  - The Access Point functionality in eapol_auth_key_handle in eapol.c in iNet wireless daemon (IWD) before     2.14 allows attackers to gain unauthorized access to a protected Wi-Fi network. An attacker can complete     the EAPOL handshake by skipping Msg2/4 and instead sending Msg4/4 with an all-zero key. (CVE-2023-52161)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2024-38faa9a2a8 advisory.

  - The Access Point functionality in eapol_auth_key_handle in eapol.c in iNet wireless daemon (IWD) before     2.14 allows attackers to gain unauthorized access to a protected Wi-Fi network. An attacker can complete     the EAPOL handshake by skipping Msg2/4 and instead sending Msg4/4 with an all-zero key. (CVE-2023-52161)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 / 12 host has a package installed that is affected by a vulnerability as referenced in the dsa-5631 advisory.

  - The Access Point functionality in eapol_auth_key_handle in eapol.c in iNet wireless daemon (IWD) before     2.14 allows attackers to gain unauthorized access to a protected Wi-Fi network. An attacker can complete     the EAPOL handshake by skipping Msg2/4 and instead sending Msg4/4 with an all-zero key. (CVE-2023-52161)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has a package installed that is affected by a vulnerability as referenced in the dla-3738 advisory.

  - The Access Point functionality in eapol_auth_key_handle in eapol.c in iNet wireless daemon (IWD) before     2.14 allows attackers to gain unauthorized access to a protected Wi-Fi network. An attacker can complete     the EAPOL handshake by skipping Msg2/4 and instead sending Msg4/4 with an all-zero key. (CVE-2023-52161)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
194701	Fedora 40 : iwd / libell (2024-58c59bfa4c)	Nessus	Fedora Local Security Checks	high
194688	Fedora 40 : iwd (2024-3fa713f2e0)	Nessus	Fedora Local Security Checks	high
192168	Fedora 39 : iwd (2024-4ef5edfb2a)	Nessus	Fedora Local Security Checks	high
191732	Fedora 39 : iwd / libell (2024-fdce971b84)	Nessus	Fedora Local Security Checks	high
191730	Fedora 38 : iwd / libell (2024-38faa9a2a8)	Nessus	Fedora Local Security Checks	high
190967	Debian dsa-5631 : iwd - security update	Nessus	Debian Local Security Checks	high
190897	Debian dla-3738 : iwd - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2023-52161

high

Tenable Plugins

high

high

high

high

high

high

high