@jbyun wrote:
Are you certain about this?
I found this online.
https://exchange.xforce.ibmcloud.com/collection/396ecb6880625d6e58dd7636b7c8e8fd
"According to the announcement linked below, if even only one of the devices (client or access point) has been patched, the pair are not vulnerable to this form of attack."
I was unable to locate the original announcement that it references.
The set of vulnerbilities can be divided into two groups.
The 4-way handshake and group key vulnerability affects the CLIENT side. Patching the AP side will do nothing to control this.
The 802.11r FT handshake vulnerability affects the AP side. Patching the AP side, or disabling 802.11r on the AP side, is sufficient to mitigate this vulnerability. Patching the client side alone does not stop the attack.
Conclusion: Updates are needed on both sides.
Aruba APs can sometimes act like clients (mesh mode, primarily). That's why Aruba is affected by both groups of vulnerabilities. However, if you disable 802.11r and are not using mesh, you can safely delay updating your Aruba software.