CAPWAP, the Control and Provisioning of Wireless Access Points protocol, is used to centrally manage access points from a wireless controller. It carries control traffic for configuration, monitoring, firmware management, and often a separate tunnel for client data. In a normal enterprise WLAN, CAPWAP lets administrators manage many APs as one system instead of configuring each device manually.
In cyber security, CAPWAP matters because it is part of the trusted control plane between wireless infrastructure devices. If attackers can reach or impersonate CAPWAP sessions, they may disrupt wireless service, alter AP behavior, or use the management path to learn about the network. Defenders should restrict CAPWAP to known controllers and APs, segment it from user traffic, and watch for unexpected CAPWAP flows or rogue devices. On exposed appliances, reducing unnecessary CAPWAP access can shrink the attack surface and limit opportunities for abuse.