The Safety System Keeping 6 GHz Wi-Fi Away From Critical Infrastructure Has Serious Holes
Researchers say the automated gatekeeper that stops modern Wi-Fi from crashing radio towers and public safety networks can be tricked, and some equipment makers are slow to take it seriously.
Key points
- Researchers from Pennsylvania State University and Idaho National Laboratory will present findings at Black Hat USA 2026 showing that a key Wi-Fi safety system has exploitable weaknesses.
- The system in question, called Automated Frequency Coordination (AFC), is supposed to stop powerful 6 GHz Wi-Fi signals from disrupting emergency networks and cellular backhaul links.
- Attackers could feed the AFC system false location data to grab unauthorized broadcast power, or block devices from getting valid permissions at all, disabling 6 GHz Wi-Fi entirely.
- A second research paper published this year demonstrated a working, real-world attack against commercial Wi-Fi equipment by impersonating an AFC server.
- Some vendors contacted by the research team acknowledged the issues; others pushed back, citing usability concerns.
Most people have no idea there's a digital gatekeeper standing between their new Wi-Fi router and the radio systems that emergency services and cellular networks depend on. That gatekeeper is called Automated Frequency Coordination, or AFC. Its job: before a Wi-Fi access point, the hardware box that broadcasts wireless internet, can use the fast 6 GHz band, it must check in with an AFC server and get permission to broadcast on specific channels at specific power levels. The server checks the device's location and makes sure it won't trample on protected signals nearby.
Researchers at Penn State and Idaho National Laboratory have now spent months pulling at that system's seams. What they found isn't reassuring.
The AFC server trusts a lot of information it receives from outside itself. Location data from GPS or other positioning systems. Time signals from a protocol called NTP (Network Time Protocol), which keeps clocks synchronised across the internet. Domain name lookups, which translate human-friendly addresses into the numerical addresses computers actually use. None of those inputs are strongly verified, and an attacker who can manipulate any one of them can feed the AFC server a lie.
What could actually go wrong for ordinary people?
The damage falls into two broad categories. A bad actor could fake a device's location to make the server think the router sits somewhere with fewer restrictions, authorising higher broadcast power that bleeds into frequencies used by public safety networks or radio observatories. More immediately disruptive: an attacker could do the opposite, flooding the system with bogus location reports or poisoned domain lookups to stop access points from ever receiving valid permissions and shutting 6 GHz Wi-Fi down for everyone in range.
No attacks matching these descriptions have been recorded in the wild. But Yilu Dong, a doctoral candidate at Penn State and one of the researchers behind the work, told Dark Reading that even a confused consumer could accidentally cause interference by trying to boost their own router's range and bypassing the AFC check. "Even consumer-level 6-GHz devices can still cause interference that leads to degradation in the channel," Dong told Dark Reading, "and in some very severe cases it can even put a channel into an unusable state."
Architecturally, the trust boundary was drawn in the wrong place from the start. The channel between a Wi-Fi access point and an AFC server is encrypted with TLS (transport layer security), so nobody eavesdrops on that conversation. Everything feeding into the conversation from outside, location, time, naming services, arrives trusted by default.
Two white papers came out of this research. The second, released last month, describes what the team calls the first practical proof-of-concept attack against commercial equipment: an attacker impersonates an AFC server and injects false instructions entirely. We first picked up this subject on 14 July 2026, when FSB-linked actors were found manipulating network gear at critical infrastructure operators, a reminder that radio-adjacent trust assumptions aren't purely academic.
Proposed fixes include using multiple independent location sources, building in detection for suspicious location jumps, and switching to more secure versions of the time and naming protocols involved. Co-researcher Tianchang Yang told Dark Reading that vendors won't overhaul AFC quickly, but they're now aware of the problems.
Watch the Black Hat USA 2026 session. If vendors treat "usability" as a reason to leave these inputs unvalidated, the next postmortem will say exactly that.
