Bug 514986 - Wifi with tunnelled EAP: not specifying CA leaves users vulnerable to MITM
Summary: Wifi with tunnelled EAP: not specifying CA leaves users vulnerable to MITM
Status: REPORTED
Alias: None
Product: systemsettings
Classification: Applications
Component: kcm_networkmanagement (other bugs)
Version First Reported In: 6.5.5
Platform: Fedora RPMs Linux
: NOR normal
Target Milestone: ---
Assignee: Plasma Bugs List
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2026-01-23 18:36 UTC by kde-cs
Modified: 2026-01-23 18:56 UTC (History)
1 user (show)

See Also:
Latest Commit:
Version Fixed/Implemented In:
Sentry Crash Report:

Attachments
Add an attachment

Note You need to log in before you can comment on or make changes to this bug.
Description kde-cs 2026-01-23 18:36:34 UTC 
SUMMARY

When configuring a wifi connection with WPA/WPA2 Enterprise security using a tunnelled EAP method (TTLS or PEAP), not selecting a CA file disables certificate checking of RADIUS server certificates. This leaves users vulnerable to MITM attacks which expose tunnelled credentials.

STEPS TO REPRODUCE
1. Configure a wifi connection.
2. Select WPA/WPA2 Enterprise.
3. Select PEAP or TTLS (configure all necessary login and second phase data).
4. Leave CA certificate empty.
5. Connect to a WPA/WPA2 enterprise wifi with an EAP method configured that matches the one configured above and use a self-signed certificate for the RADIUS server.

OBSERVED RESULT

Any self-signed RADIUS server certificate is accepted.

EXPECTED RESULT

A RADIUS server certificate signed by an unknown CA should be rejected.

SOFTWARE/OS VERSIONS
Linux/KDE Plasma:
KDE Plasma Version: 6.5.5
KDE Frameworks Version: 6.22.0 
Qt Version: 6.10.1

ADDITIONAL INFORMATION

The network manager documentation (https://networkmanager.dev/docs/api/1.46/settings-802-1x.html
) says:

"ca-cert: […] This property can be unset even if the EAP method supports CA certificates, but this allows man-in-the-middle attacks and is NOT recommended. […]"

It also says:

"system-ca-certs: When TRUE, overrides the "ca-path" and "phase2-ca-path" properties using the system CA directory specified at configure time with the --system-ca-path switch. [...]"

A possible workaround would be to set "system-ca-certs" to "TRUE" if "ca-cert" is unset in the network settings. This would let a connection to a RADIUS server fail if it's signed by an unknown CA.