A recently discovered WiFi vulnerability allows attackers to effectively recreate the promiscuous shared-media environment of early Ethernet (Thick Yellow Cable). By exploiting WiFi's power-saving frame buffering mechanism, any connected client can impersonate another device's sleep state, then force access points to release queued frames with attacker-chosen encryption or none at all. Combined with unicast Gratuitous ARP poisoning and IPv6 Router Advertisement injection, an attacker can insert themselves into the forwarding path, hijack TCP sessions, and perform DNS interception — all within any unprotected VLAN lacking Source Address Validation Improvement (SAVI) controls.
Questions this post answers
How does the WiFi frame buffering vulnerability allow an attacker to intercept other clients' traffic?
Modern WiFi protocols let a client signal it is sleeping so the access point buffers its inbound packets. Any other client on the same network can send this sleep frame on behalf of a victim. Many access points can then be tricked into releasing the buffered frames using an attacker-chosen encryption key — or completely unencrypted — exposing the victim's traffic to the attacker. Network engineers hardening WiFi deployments track vulnerabilities like this on daily.dev.
How can an attacker use unicast Gratuitous ARP to insert themselves into the forwarding path on a WiFi network?
Sending a unicast GARP for the victim's IP to the first-hop router's MAC convinces the router to forward the victim's traffic to the attacker. Simultaneously, sending a unicast GARP for the router's IP to the victim redirects the victim's off-subnet traffic through the attacker. Unicast is required so the victim cannot detect and defend against the ARP announcement. This works on any subnet without SAVI protections. Security-focused engineers dealing with Layer 2 attack surfaces find relevant coverage on daily.dev.