Loading story…
Researchers reported AirSnitch, a set of attack techniques that bypass Wi‑Fi client isolation—a common router/access point feature intended to prevent devices on the same network (e.g., guest Wi‑Fi) from communicating directly. The work indicates the issue is not a simple “Wi‑Fi encryption is broken” narrative; rather, an attacker who is already connected to the network can impersonate other devices and intercept or manipulate traffic that isolation controls were expected to block, undermining assumptions used in home, office, and enterprise deployments.
The described methods enable man-in-the-middle, traffic injection, and data interception against both wireless and wired devices, leveraging weaknesses across areas such as group key handling and network forwarding/routing behavior. Reported techniques include abuse of shared group keys, gateway bouncing, port stealing via MAC spoofing, and broadcast reflection; testing found all evaluated routers were vulnerable to at least one technique, with potential follow-on impacts such as cookie theft, DNS poisoning, and broader session compromise. Recommended mitigations emphasize treating client isolation as insufficient as a primary boundary and prioritizing network segmentation and strong end-to-end encryption, alongside improvements to group key management.
Get the actors, campaigns, and ATT&CK mapping behind it.
4 events from the most recent confirmed update back to the earliest known activity.
Subsequent technical commentary described AirSnitch as exploiting Layer 1 and Layer 2 behaviors and failures to bind client identity consistently across layers and SSIDs. This analysis emphasized that attackers could gain a full bidirectional machine-in-the-middle position on the same SSID, a different SSID, or another network segment connected to the same access point.
HKCERT published a security bulletin warning that the AirSnitch attack could cause sensitive information disclosure and denial-of-service conditions in Wi-Fi environments. The advisory marked an official security-notice response to the newly disclosed attack class.
The AirSnitch research found every router tested was vulnerable to at least one technique, including shared group key abuse, gateway bouncing, port stealing via MAC spoofing, and broadcast reflection. The disclosure highlighted that both wireless and wired devices on the same network could be affected and recommended stronger segmentation, end-to-end encryption, and improved group key management.
Researchers from the University of California, Riverside reported fundamental weaknesses in Wi-Fi Client Isolation and described bypass techniques collectively named AirSnitch. The techniques allow indirectly communicating with supposedly isolated devices and can enable traffic injection, interception, and man-in-the-middle attacks across home, enterprise, and university networks.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
5 references tracked. Mallory keeps watching after this page renders.
kaspersky.com
Open sourceschneier.com
Open sourcehkcert.org
Open sourcevulnu.com
Open sourcescworld.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers from the University of California, Riverside disclosed **AirSnitch**, a set of Wi‑Fi weaknesses that allow an attacker who is already connected to a network to **impersonate another client and divert traffic** in ways that defeat common assumptions behind *client isolation*. The technique exploits a lack of cryptographic binding between a client’s **MAC address**, **Wi‑Fi encryption keys**, and **IP address** across the lower layers of the networking stack, enabling what Ars Technica describes as **cross‑layer identity desynchronization** that can be leveraged for **full bidirectional machine‑in‑the‑middle (MitM)** interception and modification of traffic. Both reports emphasize that AirSnitch is not a classic break of Wi‑Fi ciphers like WEP/WPA; instead, it targets overlooked behavior in **Layers 1–2** and how identity is tracked across layers and network names (e.g., **SSIDs**). The researchers warned that these primitives could enable higher-level follow-on attacks such as **cookie theft**, **DNS poisoning**, and **cache poisoning**, and noted the work was presented at the **2026 Network and Distributed System Security Symposium (NDSS)**; the practical risk is highest where adversaries can gain any foothold on the same Wi‑Fi infrastructure (including scenarios involving multiple SSIDs or segments tied to the same access point).
Jun 29, 2026
Researchers disclosed two major Wi‑Fi weaknesses that undermined protections widely assumed to be provided by WPA2. The **KRACK** attack, discovered by Mathy Vanhoef, abused the WPA2 four-way handshake to force key reinstallation, allowing a nearby attacker to replay, decrypt, or forge traffic and in some cases hijack TCP sessions or inject malicious content. Because the flaw targeted the protocol rather than a single product, it affected home, office, and public Wi‑Fi environments across many vendors and platforms, with **Android 6.0 and Linux** described as especially exposed due to implementations that could reset encryption keys to all zeros; Windows and iOS were considered harder to exploit. Security agencies and vendors, including CERT/CC, NCSC, Microsoft, and Google, issued warnings and began releasing patches. A later disclosure, **KrØØk** (`CVE-2019-15126`), showed that unpatched **Broadcom** and **Cypress** Wi‑Fi chipsets could encrypt some packets with an all-zero key after disassociation, letting nearby attackers decrypt portions of wireless traffic. ESET said the bug affected more than **one billion devices**, including smartphones, laptops, IoT products, routers, and access points from vendors such as Amazon, Apple, Google, Samsung, Asus, Huawei, Xiaomi, and Raspberry Pi. Although KrØØk was related to KRACK, it was a distinct flaw, and both incidents reinforced the same operational guidance: changing a Wi‑Fi password does not fix protocol or chipset weaknesses, while timely firmware and OS updates, plus relying on **HTTPS**, **VPNs**, or other end-to-end encryption for sensitive activity, materially reduce exposure.
Jun 29, 2026
TP-Link disclosed multiple vulnerabilities in ISP-managed **Aginet** networking products, including mesh systems, routers, PON devices, and xDSL modems, with the most serious flaws enabling privileged control of affected devices. The issues include **authentication bypass** in the web management interface (`CVE-2025-30237`, CVSS 8.7), **privilege escalation** in user management (`CVE-2025-30238`, CVSS 8.6), **hardcoded cryptographic keys** that can expose sensitive configuration data (`CVE-2025-30239`, CVSS 8.5), and **OS command injection** in web interface components (`CVE-2025-30241`, CVSS 8.6). TP-Link said exploitation conditions vary by flaw, with some attacks requiring adjacent network access, valid credentials, or access to device storage, while others can be triggered through crafted unauthenticated requests. TP-Link published fixed firmware versions for many country- and ISP-specific model variants and said remediation for ISP-managed devices will be coordinated through service providers. The vendor advised customers to update firmware through device management interfaces or companion applications, restrict access to web administration services, review privileges for unauthorized changes, and contact their ISP if patches are not yet available. Successful exploitation could allow attackers to execute arbitrary commands, create privileged accounts, alter critical settings, or recover embedded keys and decrypt protected data, potentially leading to full device compromise.
Aug 14, 2026