CVE-2008-1114

Vocera Communications wireless handsets, when using Protected Extensible Authentication Protocol (PEAP), do not validate server certificates, which allows remote wireless access points to steal hashed passwords and conduct man-in-the-middle (MITM) attacks.

Score

CVSS 2.0 4.3 Medium

Status

Modified - cve@mitre.org

Published

2008-03-03

Last modified

2024-09-17

Weaknesses

CWE-20

Affected products

• Wireless Handset (Vocera)

References

• http://blogs.zdnet.com/security/?p=896
• http://blogs.zdnet.com/security/?p=901
• http://seclists.org/fulldisclosure/2008/Feb/0402.html
• http://www.securityfocus.com/bid/27935
• http://www.vocera.com/downloads/InfrastructureGuide.pdf