AirSnitch Breaks Every Wi-Fi Network Tested

TL;DR: On February 25, 2026, researchers from UC Riverside and KU Leuven presented AirSnitch at the NDSS Symposium in San Diego. It's a toolkit of attacks that bypass "client isolation," the Wi-Fi feature that's supposed to stop users on the same network from attacking each other. They tested 11 routers from Cisco, Netgear, D-Link, ASUS, TP-Link, Ubiquiti, Tenda, and LANCOM, plus open-source firmware DD-WRT and OpenWrt. Every single one was vulnerable to at least one attack. WPA2, WPA3, enterprise networks with individual logins: none of it mattered. If an attacker connects to the same Wi-Fi network as you, they can intercept your traffic, read your data, and launch machine-in-the-middle attacks. The fix isn't a firmware patch. It's an architectural problem that demands changes to the IEEE 802.11 standard itself.

What Is AirSnitch?

AirSnitch is the name researchers gave to a set of three attacks that systematically defeat Wi-Fi client isolation. Client isolation is a feature built into routers that's supposed to create invisible walls between devices on the same network: your laptop shouldn't be able to see or attack the phone of the person sitting next to you at a coffee shop.^[1]

Turns out, those walls are made of tissue paper.

Lead researcher Xin'an Zhou (now at Palo Alto Networks) and his team at UC Riverside, alongside noted Wi-Fi security researcher Mathy Vanhoef at KU Leuven in Belgium, found three fundamental weaknesses in how routers implement client isolation. Not bugs in specific firmware versions. Structural flaws in how the entire system works.^[2]

"Enterprise systems usually protect their networks using the most advanced encryption. So that means enterprises are seemingly relying on a fake sense of security," Zhou said.^[2]

The Three Attacks

AirSnitch isn't one trick. It's three, each exploiting a different layer of the Wi-Fi stack. Every router tested was vulnerable to at least one.^[1]

1. GTK Abuse (Encryption Layer)

Wi-Fi networks use something called a Group Temporal Key (GTK), a shared encryption key that all devices on the network receive for handling broadcast traffic. It's like a communal mailbox key that every tenant in the building gets a copy of.^[3]

Attackers exploit this by crafting broadcast frames that spoof the access point's MAC address. Because the GTK is shared, the attacker can inject malicious frames directly to victims, even on WPA3 and Passpoint-secured networks. The group key management simply wasn't designed to prevent this.^[3]

2. Gateway Bouncing (Routing Layer)

Many routers enforce client isolation at Layer 2 (the data link layer) but forget about Layer 3 (the network layer). That's like locking the front door but leaving the back window open.^[3]

The attacker sends packets to the router's gateway using the victim's IP address as the destination. The gateway dutifully routes the packets back, straight to the victim, bypassing the Layer 2 isolation entirely. The router's own routing logic becomes the attack vector.^[3]

3. Port Stealing (Switching Layer)

This one's elegant in a terrifying way. The attacker spoofs the victim's MAC address and associates with a different BSSID (essentially, a different virtual network on the same access point). The access point's internal switching logic gets confused and rebinds the victim's MAC to the attacker's port.^[3]

Result: traffic that should go to the victim goes to the attacker instead. Encrypted traffic. All of it. Silently redirected.

What They Tested

The researchers didn't just pick easy targets. They tested 11 Wi-Fi systems spanning the market:^[1][3]

Consumer routers: Netgear, TP-Link, D-Link, ASUS, Tenda
Enterprise gear: Cisco, Ubiquiti, LANCOM
Open-source firmware: DD-WRT, OpenWrt

Every single device was vulnerable to at least one of the three attacks. Not most. Not a majority. All of them.^[1]

The attacks worked across:

WPA2-Personal (your typical home network password)
WPA3-Personal (the "upgraded" home security)
WPA2/WPA3-Enterprise (corporate networks with individual RADIUS logins)
Passpoint (the "secure" hotspot standard)

Even enterprise networks that require individual login credentials (the kind your IT department promises are safe) fell to AirSnitch.^[2]

Why This Is a Big Deal

Client isolation isn't some obscure feature. It's the reason you're told public Wi-Fi is "safe enough" at airports, hotels, and coffee shops when WPA3 is enabled. It's supposed to mean that even though you're sharing a network with strangers, they can't touch your traffic.

AirSnitch proves that's a lie. And not just for cheap home routers, but for Cisco enterprise gear and Ubiquiti access points running the latest firmware.

The attack requires the attacker to be on the same Wi-Fi network. That's it. No special hardware. No zero-day exploits. Just a laptop and the AirSnitch toolkit (which the researchers have published on GitHub).^[4]

Once an attacker has positioned themselves between you and your traffic, they can:

Read unencrypted data in transit
Intercept DNS queries to see what sites you visit
Inject malicious content into unencrypted web pages
Redirect you to phishing sites
Downgrade HTTPS connections in some configurations
Capture credentials sent over insecure protocols

There's No Quick Patch

Here's the bad news: this isn't something a firmware update can fix.

Client isolation was never standardized by the IEEE (the body that writes the 802.11 Wi-Fi standards). Every manufacturer implemented it differently, and none of them got it right. The researchers found that the problem is architectural: it requires changes at the IEEE standards level.^[2]

That means we're looking at years, not months, before the underlying issue gets addressed. New standards need to be written, hardware needs to be updated, and routers need to be replaced. The typical Wi-Fi infrastructure refresh cycle is measured in years.

In the meantime, every Wi-Fi network you connect to is potentially vulnerable to someone else on that same network.

What You Can Do Right Now

Use a VPN on Shared Networks

A VPN encrypts your traffic end-to-end before it hits the Wi-Fi layer. Even if an attacker intercepts your packets via AirSnitch, they get encrypted gibberish. This is your single best defense. See our VPN comparison.

Verify HTTPS Everywhere

HTTPS protects data between your browser and the website. AirSnitch can intercept traffic but can't break TLS encryption. Make sure every site you visit shows the padlock, and never click through certificate warnings.

Avoid Sensitive Tasks on Public Wi-Fi

Banking, medical records, work email: save these for networks you control. AirSnitch makes any shared network a potential surveillance point.

Segment Your Home Network

Put IoT devices, guests, and your main devices on separate VLANs. Proper VLAN separation can neutralize several AirSnitch attack vectors, according to the researchers.

For a detailed protection guide, read our companion article: How to Protect Yourself from AirSnitch.