CVE-2017-13077 describes a vulnerability in Wi-Fi Protected Access (WPA and WPA2) that allows an attacker to reinstall the Pairwise Transient Key (PTK) Temporal Key (TK) during the four-way handshake. This flaw, affecting various products including canonical, debian, and redhat, enables an attacker within radio range to replay, decrypt, or spoof Wi-Fi frames. With a CVSS score of 6.8 (Medium), this vulnerability has a high impact on confidentiality and integrity, but requires high attack complexity and adjacent network access. Although the EPSS score is low, indicating a low probability of exploitation, the potential for significant data compromise is present. Currently, there is no public exploit code available in Metasploit, Nuclei, or ExploitDB, and it is not listed in CISA's KEV catalog. Despite this, the vulnerability garnered significant community discussion and media coverage at the time of its disclosure, highlighting its perceived importance.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
14.04CPE matchmatch criteria | cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:* | ||
16.04CPE matchmatch criteria | cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* | ||
17.04CPE matchmatch criteria | cpe:2.3:o:canonical:ubuntu_linux:17.04:*:*:*:*:*:*:* | ||
8.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* | ||
9.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.0 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.