A new wireless vulnerability affecting WPA2 protected wireless networks was published by security researchers on Monday as first reported by ArsTechnica.

A paper by two Belgian researchers has cast more light on the vulnerabilities discovered in the Wi-Fi Protected Access II (WPA2) implementations on most, if not all, wireless networking devices that use the protocol. Dubbed "KRACK" (Key Reinstallation AttaCK), the attack "abuses design or implementation flaws in cryptographic protocols to reinstall an already-in-use key," wrote Mathy Vanhoef and Frank Piessens of the Katholieke Universiteit Leuven (KU Leuven) in the paper, released today.

Notably, the vulnerabilities and proofs-of-concept exploit code affect the widely used WPA2 standard, rendering nearly every wireless device vulnerable.

Risks to clients include the interception and potential decryption of traffic (eavesdropping) as well as injection of malicious code and payloads. These risks are partially mitigated by the fact that local access to the wireless network is required to conduct the attack – remote exploitation is not possible.

Our clients are urged to immediately evaluate the risks to their environment based on threats that they face. Major Wi-Fi vendors have begun to roll-out patches and updates to affected devices which US-CERT is tracking on its website. The issue is documented by MITRE as CWE-323: Using a Nonce, Key Pair in Encryption. Clients who need assistance with remediating this issue are urged to contact us immediately!