I have an access point that subscribes in the list of connected devices all the devices that try to connect to it, even if they give a wrong password.
The device does not give them an IP address but they are saved as valid devices using their MAC address.
I reported it in my work as a critical security issue but I don't know how to defend my opinion. Can anyone tell me the possible ways to exploit this vulnerability or other tests to do to verify the validity of my work?
For Example, is there a message in the 802.11 standard that broadcasts valuable information to connected devices that the malicious devices can sniff.