EAPOL Encryption Downgrade Vulnerability in Cisco Small Business Wireless Access Points

CVE-2018-0412

Summary

A security issue in the Extensible Authentication Protocol over LAN (EAPOL) implementation of Cisco's Small Business 100 and 300 Series Wireless Access Points allows an unauthenticated adjacent attacker to force a downgrade of the encryption algorithm used during the Wi-Fi handshake. By exploiting improper processing of EAPOL messages, an attacker can manipulate the communication between the access point and a Wi-Fi client, potentially shifting from the secure AES-CCMP cipher to the less secure WPA-TKIP cipher. This exposure may facilitate cryptographic attacks that could compromise confidential information.

References