The IEEE 802.11 specifications through 802.11ax allow physically proximate attackers to intercept (possibly cleartext) target-destined frames by spoofing a target's MAC address, sending Power Save frames to the access point, and then sending other frames to the access point (such as authentication frames or re-association frames) to remove the target's original security context. This behavior occurs because the specifications do not require an access point to purge its transmit queue before removing a client's pairwise encryption key.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Aruba Aos 10 | — | The following firmware versions address the Fast Reconnect attack:
ArubaOS Wi-Fi Controllers and Gateways
- 8.10.0.0 and above
- 8.6.0.21 and above (Release ETA - Late April 2023)
Aruba InstantOS / Aruba Access Points running ArubaOS 10
- 10.3.1.1 and above
- 8.10.0.0 and above
- 8.6.0.19 and above
- 6.5.4.24 and above
- 6.4.4.8-4.2.4.21 and above
Aruba Instant On Access Points
- 2.9 and above - Please note this will auto-update in
Early October 2023. Customer action is not required.
Aruba does not evaluate or patch product versions that
have reached their End of Development milestone. For more
information about Aruba's End of Support policy visit:
https://www.arubanetworks.com/support-services/end-of-life/ | Jan 14, 2025 | Mar 30, 2023 |
| Aruba Aos 8 | — | The following firmware versions address the Fast Reconnect attack:
ArubaOS Wi-Fi Controllers and Gateways
- 8.10.0.0 and above
- 8.6.0.21 and above (Release ETA - Late April 2023)
Aruba InstantOS / Aruba Access Points running ArubaOS 10
- 10.3.1.1 and above
- 8.10.0.0 and above
- 8.6.0.19 and above
- 6.5.4.24 and above
- 6.4.4.8-4.2.4.21 and above
Aruba Instant On Access Points
- 2.9 and above - Please note this will auto-update in
Early October 2023. Customer action is not required.
Aruba does not evaluate or patch product versions that
have reached their End of Development milestone. For more
information about Aruba's End of Support policy visit:
https://www.arubanetworks.com/support-services/end-of-life/ | Jan 14, 2025 | Mar 30, 2023 |
| Freebsd | — | Upgrade FreeBSD | Sep 7, 2023 | Sep 7, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub