What security feature did your router vendor quietly add to stop Wi-Fi users from attacking each other? It doesn't work. A team of academic researchers just proved it — on every single network they tested.
Researchers from the University of California, Riverside, and KU Leuven's DistriNet lab presented a paper at the NDSS Symposium 2026 in San Diego revealing that client isolation — the mechanism routers use to prevent one Wi-Fi client from snooping on or injecting traffic toward another — can be systematically defeated across WPA2 and WPA3 networks, from cheap home routers to enterprise deployments protecting corporate data.
The attack toolkit they built is called AirSnitch, and its results are stark: not one of the routers or networks tested was immune.
What "Client Isolation" Was Supposed to Do
Client isolation (sometimes called AP isolation) is a vendor-added feature that tells an access point to block direct communication between connected clients. It was designed to stop classic attacks like ARP poisoning — tricks that have long allowed a malicious user on the same network to redirect traffic through their own device.
The problem, as the researchers discovered, is that client isolation was never formally standardized in the IEEE 802.11 Wi-Fi specification. Every vendor implemented it in their own way, leading to a patchwork of inconsistent, incomplete protections with enormous gaps.
Three Ways AirSnitch Tears It Apart
The researchers identified three distinct attack classes, each exploiting a different layer of the network stack.
1. GTK Abuse (The Shared Key Problem)
Modern Wi-Fi networks use a shared Group Temporal Key (GTK) — a single broadcast encryption key distributed to every client on a given access point. Even with client isolation enabled, all clients hold this key.
AirSnitch exploits this by wrapping a targeted, unicast packet inside a broadcast-addressed frame encrypted with the GTK and spoofing the AP's MAC address. Victim devices treat it as legitimate broadcast traffic from the router, completely bypassing wireless-layer isolation.
The attack works against WPA2 and WPA3. Critically, the Passpoint standard — which was specifically designed to mitigate exactly this kind of group-key abuse in public hotspots — was also found to be flawed by design, as it fails to randomize group keys across certain handshakes like Fast BSS Transition and WNM-Sleep Responses.
2. Gateway Bouncing (The Routing Layer Gap)
Many routers enforce isolation at Layer 2 (the MAC address level) but never extend the check to Layer 3 (IP routing). An attacker can send a packet addressed to the gateway's MAC address, with the victim's IP address as the destination.
The gateway accepts it — it sees its own MAC — and then dutifully routes the packet onward to the victim. The victim receives traffic injected by the attacker, who never directly communicated with them at the MAC layer. It's a deliberate mismatch between two layers that were supposed to work together.
3. Port Stealing (The Switching Layer Identity Problem)
The most severe technique repurposes a classic wired-network attack for the Wi-Fi world. By connecting to the same access point using a victim's spoofed MAC address — but on a different frequency band or SSID — an attacker tricks the AP's internal switching table into associating the victim's MAC with the attacker's network port.
From that moment, the traffic the AP intended to deliver to the victim is instead sent to the attacker, encrypted with the attacker's own session keys. In the worst-case scenario, when the attacker connects to an open (unencrypted) SSID, the victim's previously WPA2/3-protected traffic is forwarded to the attacker in plaintext, visible to anyone within radio range.
The Real-World Damage
The researchers tested 5 consumer routers (Netgear, Tenda, D-Link, TP-Link, ASUS), two open-source router platforms (DD-WRT and OpenWrt), and enterprise hardware from Ubiquiti, Cisco, and LANCOM — all with client isolation enabled. Every device was vulnerable to at least one attack.
They also validated the attacks in a live setting on two university networks, successfully intercepting downlink traffic from their own test devices connected to WPA2-Enterprise (the type that requires individual login credentials and is widely assumed to be the safest Wi-Fi option).
The attack completed in roughly two seconds on a Netgear R8000, while a victim was streaming a YouTube video without noticeable interruption.
Lead researcher Xin'an Zhou told Ars Technica that AirSnitch "breaks worldwide Wi-Fi encryption, and it might have the potential to enable advanced cyberattacks," and that advanced attacks could build on these primitives to perform cookie theft and other credential-harvesting attacks.
Once an attacker achieves man-in-the-middle positioning, the implications extend well beyond passive snooping. The researchers demonstrated brute-forcing the RADIUS server passphrase (used in enterprise authentication) after intercepting just a single authentication packet, effectively compromising the entire enterprise Wi-Fi onboarding infrastructure. DNS poisoning, DHCP manipulation, and HTTPS session hijacking via unpatched TLS implementations — all become accessible once isolation breaks.
This Is an Architecture Problem, Not a Patch Problem
The research team is clear that firmware updates alone won't fix this. The attack chain is architectural, and meaningful mitigation demands revision at the IEEE standards level.
That said, there are concrete steps network administrators can take right now:
- Replace shared-password Wi-Fi (WPA2/3-Personal) with WPA2/3-Enterprise in any environment handling sensitive data — shared passwords allow trivially deriving session keys
- Put guest and trusted SSIDs on separate VLANs, ideally on physically separate infrastructure — the team confirmed that TP-Link EAP613's VLAN configuration successfully neutralized the port stealing attacks
- Harden your RADIUS server passphrase — the attack demonstrated that weak back-end secrets can be cracked from a single intercepted packet
- Keep AP firmware updated — several vendors, including LANCOM, have already pushed fixes; the Wi-Fi Alliance has patched the IGTK randomization gap in Passpoint v3.4
- Monitor for duplicate MAC associations across BSSIDs, which is a strong indicator of port stealing in progress
The research code is publicly available at GitHub, allowing network administrators and security teams to test their own deployments.
The deeper issue, as the paper concludes, is that client isolation was added by vendors without proper public review or standardization. After years of being marketed as a reliable defense, it has turned out to be one of the most consequential security assumptions in wireless networking — and a false one.