topic Re: SSID Confusion attack in Wireless

SSID Confusion attack

gagandeep singh3 — Wed, 29 May 2024 19:56:46 GMT

Hi,

I would like to know if Meraki has some taken any steps to mitigate this vulnerability.

We are:
- using WPA2 encryption and not WPA3
- using RADIUS authentication

I hope Meraki will release a patch to mitigate the vulnerability. Does anyone know or shed some light on the steps that Meraki is going to take or is advising the customers ?

Re: SSID Confusion attack

aleabrahao — Wed, 29 May 2024 19:58:10 GMT

What vulnerability? Do you have the CVE?

Re: SSID Confusion attack

gagandeep singh3 — Wed, 29 May 2024 20:00:37 GMT

SSID Confusion Attack WiFi Vulnerability (CVE-2023-52424)

Re: SSID Confusion attack

aleabrahao — Wed, 29 May 2024 20:06:34 GMT

This CVE is from 2023, Meraki has probably already released the fix some time ago, as they frequently release new updates.

Have you already contacted support?

Re: SSID Confusion attack

Raphael_L — Wed, 29 May 2024 20:13:12 GMT

Doubt that Meraki has published a fix for that. The CVE was published this month.

Re: SSID Confusion attack

Rasmus Hoffmann Birkelund — Wed, 29 May 2024 21:10:13 GMT

Without knowing exactly what the underlying mechanisms is in this specific CVE, from what I'm reading about it, it's simply an overall design flaw in the 802.11 standard.

It's always been there, and will always be there.

Basically it aims at tricking a user to associate to your malicious and less secure SSID (a honeypot) and eavesdrop on all your traffic.

If you really want to mitigate it, there's an easy fix.

Turn of all your WiFi and Access Points, and cable your devices to the network.

Re: SSID Confusion attack

BlakeRichardson — Wed, 29 May 2024 23:30:09 GMT

It's a day old I doubt any vendor has patched it as it's still being analysed.

Re: SSID Confusion attack

Brash — Thu, 30 May 2024 00:47:02 GMT

There is no public bug or PSIRT for this vulnerability yet, given it's still pretty fresh.

Raise a support ticket for more information as they may already be investigating internally.

Re: SSID Confusion attack

IvanJukic — Thu, 30 May 2024 00:58:39 GMT

Hi @gagandeep singh3,

NOTE: I DO NOT KNOW, THE FULL INS AND OUTS OF THIS VULNERABILITY.

That said, Meraki Air Marshal does have some level of mitigation from Rouge SSIDs. See below guide for further details.

https://documentation.meraki.com/MR/Monitoring_and_Reporting/Air_Marshal

Re: SSID Confusion attack

Paccers — Thu, 30 May 2024 03:20:06 GMT

Original writeup came out a few weeks ago: https://www.top10vpn.com/research/wifi-vulnerability-ssid/

I wouldn't expect a fix to be released quickly, if at all!