6 GHz Wi-Fi Security Flaws Could Disrupt Critical Infrastructure
Researchers have identified significant security weaknesses in the Automated Frequency Coordination (AFC) systems for 6 GHz Wi-Fi, potentially enabling attackers to disrupt critical infrastructure by spoofing device locations.
Researchers from Pennsylvania State University and Idaho National Laboratory are raising alarms about security vulnerabilities within the Automated Frequency Coordination (AFC) systems designed to manage the 6 GHz Wi-Fi spectrum. These systems are crucial for preventing interference with vital radio communications, including cellular backhaul and public safety networks. The findings, set to be presented at Black Hat USA 2026, suggest that flaws in AFC could allow client devices to misrepresent their geographical location, leading to unauthorized access to frequencies and potentially disrupting critical services.
The core of the vulnerability lies in how AFC servers trust client-provided location data. While the communication between Wi-Fi access points (APs) and AFC servers is secured with TLS, the AFC servers themselves rely on external inputs such as GPS, GNSS, Wi-Fi-based location services, DNS, and NTP for time synchronization. Researchers argue that these out-of-band dependencies create practical attack vectors where an adversary can spoof these inputs. This could lead an AP to report a false location or time, be redirected to malicious endpoints, or have its AFC leases prematurely terminated.
Such manipulations could result in incorrect frequency and power assignments, causing harmful interference to incumbent radio services. For example, an attacker could spoof a location outside of a restricted area to gain authorization for higher transmit power, potentially impacting protected service links or radio observatories. This could also lead to denial-of-service (DoS) conditions for 6 GHz clients if APs are prevented from obtaining valid frequency authorizations.
Further exploitation scenarios include attackers spoofing locations to trigger DoS attacks by preventing APs from receiving valid AFC authorizations, effectively disabling 6 GHz operation in certain areas. Additionally, attackers could force repeated AFC connection updates, overwhelming servers with unnecessary queries and increasing their load. A separate proof-of-concept attack detailed in a recent white paper demonstrated the ability to impersonate an AFC server, inject forged responses, and launch targeted interference and DoS attacks against commercial Wi-Fi APs, highlighting implementation flaws in some AFC clients.
While no attacks have been observed in the wild to date, the researchers emphasize that the risk is tangible. Even unintentional misconfigurations or a consumer's attempt to expand their AP's coverage could inadvertently cause the interference described. The potential impact ranges from degradation of Wi-Fi channels to rendering them unusable, affecting not just consumer devices but also critical systems that rely on stable radio spectrum.
The research team has proposed several solutions to address these AFC security issues, acknowledging that implementation can be complex due to cost-efficiency considerations for stakeholders. Recommendations include enhancing geofencing capabilities, utilizing multiple location sources for verification, implementing physical-level spoofing detection, employing authenticated localization messages, securing DNS and NTP protocols, and updating system dependencies. Prioritizing location spoofing detection and disabling 6 GHz operations when anomalies are detected are highlighted as key steps.
Researchers are actively engaging with vendors who develop and utilize AFC systems to encourage prompt action. While some vendors have responded positively and are considering changes, others have expressed skepticism or a preference for maintaining current usability over implementing robust security measures. The researchers anticipate that significant changes to AFC systems may not occur rapidly, but they are committed to raising awareness and fostering collaboration to secure these critical components of modern wireless infrastructure.