CVSS 3.1
3.1 lowCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:NCVE-2026-23810
Low (3.1) in arubanetworks arubaos. EPSS 0.2% chance of exploitation in the next 30 days.
A vulnerability in the packet processing logic may allow an authenticated attacker to craft and transmit a malicious Wi-Fi frame that causes an Access Point (AP) to classify the frame as group-addressed traffic and re-encrypt it using the Group Temporal Key (GTK) associated with the victim's BSSID. Successful exploitation may enable GTK-independent traffic injection and, when combined with a port-stealing technique, allows an attacker to redirect intercepted traffic to facilitate machine-in-the-middle (MitM) attacks across BSSID boundaries.
Severity
- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 10% of CVEs (scores of 2026-10-31)
- CWE
- CWE-300
- Published
- Modified
- Record from
- the NVD, synced
Affected
- arubanetworks:arubaos