# UNDF: UNDF-2026-000001182
--- a/subsys/net/l2/wifi/wifi_mgmt.c
+++ b/subsys/net/l2/wifi/wifi_mgmt.c
@@ -396,9 +396,14 @@ static int wifi_connect(uint64_t mgmt_request, struct net_if *iface,
 # Defect ID: zephyr-0002
 # MOAD: 0004
 # Severity: HIGH
 # CVE class: CWE-312 Cleartext Storage/Exposure of Sensitive Information
 #
 # Root cause: wifi_connect() in wifi_mgmt.c dumps the WiFi PSK and SAE
 # password as raw hex via LOG_HEXDUMP_DBG on every connection attempt:
 #
 #   line 396:  LOG_HEXDUMP_DBG(params->ssid, params->ssid_length, "ssid");
 #   line 397:  LOG_HEXDUMP_DBG(params->psk, params->psk_length, "psk");
 #   line 399:  LOG_HEXDUMP_DBG(params->sae_password, params->sae_password_length, "sae");
 #
 # LOG_HEXDUMP_DBG fires at LOG_LEVEL_DBG. When a developer or board BSP sets
 # CONFIG_WIFI_LOG_LEVEL_DBG=y (common during WiFi bring-up and certification
 # testing), the PSK is dumped to the Zephyr logging backend in hex. On boards
 # with RTT, UART, or flash logging backends this exposes the network passphrase
 # in cleartext to anyone with console or log access.
 #
 # The SSID is not a credential and is fine to log. The PSK and SAE password
 # must not appear in logs at any log level.
 #
 # Fix: remove LOG_HEXDUMP_DBG for psk and sae_password. Log only the SSID,
 # channel and security type (already logged by NET_DBG two lines below).

 	LOG_HEXDUMP_DBG(params->ssid, params->ssid_length, "ssid");
-	LOG_HEXDUMP_DBG(params->psk, params->psk_length, "psk");
-	if (params->sae_password) {
-		LOG_HEXDUMP_DBG(params->sae_password, params->sae_password_length, "sae");
-	}
+	/* PATCH zephyr-0002: do not log PSK or SAE password (CWE-312). */
+	LOG_DBG("psk set: %s", params->psk_length > 0 ? "yes" : "no");
+	LOG_DBG("sae_password set: %s", (params->sae_password && params->sae_password_length > 0) ? "yes" : "no");
 	NET_DBG("ch %u sec %u", params->channel, params->security);