Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11w allows reinstallation of the Integrity Group Temporal Key (IGTK) during the four-way handshake, allowing an attacker within radio range to spoof frames from access points to clients.
Exploitability
AV:AAC:HPR:NUI:NScope
S:UImpact
C:NI:HA:N5.3/CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:NOther