Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
hostapd vulnerabilities and exploits
(subscribe to this query)
3.3
CVSSv2
CVE-2019-5062
An exploitable denial-of-service vulnerability exists in the 802.11w security state handling for hostapd 2.6 connected clients with valid 802.11w sessions. By simulating an incomplete new association, an attacker can trigger a deauthentication against stations using 802.11w, resu...
W1.fi Hostapd 2.6
4.3
CVSSv2
CVE-2019-11555
The EAP-pwd implementation in hostapd (EAP server) prior to 2.8 and wpa_supplicant (EAP peer) prior to 2.8 does not validate fragmentation reassembly state properly for a case where an unexpected fragment could be received. This could result in process termination due to a NULL p...
W1.fi Hostapd
W1.fi Wpa Supplicant
5
CVSSv2
CVE-2021-30004
In wpa_supplicant and hostapd 2.9, forging attacks may occur because AlgorithmIdentifier parameters are mishandled in tls/pkcs1.c and tls/x509v3.c.
W1.fi Hostapd 2.9
W1.fi Wpa Supplicant 2.9
6.8
CVSSv2
CVE-2022-23304
The implementations of EAP-pwd in hostapd prior to 2.10 and wpa_supplicant prior to 2.10 are vulnerable to side-channel attacks as a result of cache access patterns. NOTE: this issue exists because of an incomplete fix for CVE-2019-9495.
W1.fi Hostapd
W1.fi Wpa Supplicant
Fedoraproject Fedora 35
6.8
CVSSv2
CVE-2022-23303
The implementations of SAE in hostapd prior to 2.10 and wpa_supplicant prior to 2.10 are vulnerable to side channel attacks as a result of cache access patterns. NOTE: this issue exists because of an incomplete fix for CVE-2019-9494.
W1.fi Hostapd
W1.fi Wpa Supplicant
Fedoraproject Fedora 35
5
CVSSv2
CVE-2019-10064
hostapd prior to 2.6, in EAP mode, makes calls to the rand() and random() standard library functions without any preceding srand() or srandom() call, which results in inappropriate use of deterministic values. This was fixed in conjunction with CVE-2016-10743.
W1.fi Hostapd
Debian Debian Linux 8.0
Debian Debian Linux 9.0
5
CVSSv2
CVE-2015-8041
Multiple integer overflows in the NDEF record parser in hostapd prior to 2.5 and wpa_supplicant prior to 2.5 allow remote malicious users to cause a denial of service (process crash or infinite loop) via a large payload length field value in an (1) WPS or (2) P2P NFC NDEF record,...
W1.fi Wpa Supplicant
Opensuse Opensuse 13.2
Opensuse Opensuse 13.1
W1.fi Hostapd
5
CVSSv2
CVE-2019-9496
An invalid authentication sequence could result in the hostapd process terminating due to missing state validation steps when processing the SAE confirm message when in hostapd/AP mode. All version of hostapd with SAE support are vulnerable. An attacker may force the hostapd proc...
W1.fi Hostapd
W1.fi Wpa Supplicant
Fedoraproject Fedora 28
Fedoraproject Fedora 29
Fedoraproject Fedora 30
6.8
CVSSv2
CVE-2019-9497
The implementations of EAP-PWD in hostapd EAP Server and wpa_supplicant EAP Peer do not validate the scalar and element values in EAP-pwd-Commit. This vulnerability may allow an malicious user to complete EAP-PWD authentication without knowing the password. However, unless the cr...
W1.fi Hostapd
W1.fi Wpa Supplicant
Fedoraproject Fedora 28
Fedoraproject Fedora 29
Fedoraproject Fedora 30
4.3
CVSSv2
CVE-2019-13377
The implementations of SAE and EAP-pwd in hostapd and wpa_supplicant 2.x up to and including 2.8 are vulnerable to side-channel attacks as a result of observable timing differences and cache access patterns when Brainpool curves are used. An attacker may be able to gain leaked in...
W1.fi Hostapd
Fedoraproject Fedora 30
Canonical Ubuntu Linux 18.04
Canonical Ubuntu Linux 19.04
Debian Debian Linux 10.0
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-3661
open redirect
CVE-2024-25512
CVE-2024-33788
command injection
SSTI
CVE-2024-0043
CVE-2024-29210
CVE-2024-25510
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
4
5
NEXT »