Vocera Communications wireless handsets when using Protected Extensible Authentication Protocol (PEAP) do not validate server certificates which allows remote wireless access points to steal hashed passwords and conduct man-in-the-middle (MITM) attacks.