On October 16, 2017, a statement from the International Consortium for Advancement of Cybersecurity on the Internet (ICASI) was released alerting the industry to a series of vulnerabilities for WPA and WPA2. These vulnerabilities affect a large number of wireless infrastructure devices and wireless clients, across many vendors. This security flaw means that, for vulnerable clients and access points, WPA and WPA2-encrypted Wi-Fi traffic is no longer secure until certain steps are taken to remediate the issue. The Wi-Fi data stream,including passwords and personal data, can be intercepted, decrypted, and modified without a user’s knowledge.  Who is affected by these vulnerabilities? The vulnerability is widespread. Review the ICASI statement linked to above for additional information and CVEs. Organizations that use wireless access points (APs) relying on WPA or WPA2 encryption, and mobile users who connect to Wi-Fi networks with smartphones, tablets, laptops, and other devices, should implement the necessary patches applicable to these vulnerabilities. How many/what type of vulnerabilities are there? Refer to the ICASI list of vulnerabilities and Common Vulnerability and Exposure (CVE) identifiers here. How do the WPA and WPA2 vulnerabilities work? A malicious user could inject specially-crafted packets into the middle of the WPA/WPA2 authentication handshake, forcing installation of a key known to—or controlled by—the attacker. This results in the possibility of decrypting and/or modifying client traffic. Traffic already protected by a higher-level encryption protocol, such as HTTPS, VPNs, or application encryption would not be impacted. Read the report from Watchguard