Description
The IEEE 802.11 specifications through 802.11ax allow physically proximate attackers to intercept (possibly cleartext) target-destined frames by spoofing a target's MAC address, sending Power Save frames to the access point, and then sending other frames to the access point (such as authentication frames or re-association frames) to remove the target's original security context. This behavior occurs because the specifications do not require an access point to purge its transmit queue before removing a client's pairwise encryption key.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
toffeenutt/CVE-2022-47522-PoC ★ 0 · Feb 10, 2025
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 3
- ICSA-23-131-02 Siemens SCALANCE W1750D CISA ICS & IT advisories · Oct 10, 2023
- SSA-516174 SSA-516174: Wi-Fi Encryption Bypass Vulnerabilities in SCALANCE W1750D Siemens ProductCERT · Oct 10, 2023
- WID-SEC-2023-0776 IEEE 802.11 (WLAN): Mehrere Schwachstellen ermöglichen Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Sep 6, 2023