Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 40

Export CSV
CVE-2026-78807

wpa_supplicant: wpa_supplicant: Security bypass via missing PMKSA validation

An issue in wpa_supplicant all versions before v.2.12 allows a local attacker to bypass proper network context and AKMP matching for PMKSA caching via missing validation in the driver based PMKSA selection path in wpa.c

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
W1.fi
Products
Wpa Supplicant
CVE-2021-30004

wpa_supplicant: mishandled AlgorithmIdentifier parameters may lead to forging attacks

In wpa_supplicant and hostapd 2.9, forging attacks may occur because AlgorithmIdentifier parameters are mishandled in tls/pkcs1.c and tls/x509v3.c.

CVSS 3.1 · 4.3 Medium EPSS 1.6% KEV · Not listed
Vendors
W1.fi
Products
Hostapd Wpa Supplicant
CVE-2021-27803

wpa_supplicant: Use-after-free in P2P provision discovery processing

A vulnerability was discovered in how p2p/p2p_pd.c in wpa_supplicant before 2.10 processes P2P (Wi-Fi Direct) provision discovery requests. It could result in denial of service or other impact (potentially execution of arbitrary code), for an attacker within radio range.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed
Vendors
Debian Fedoraproject Redhat and 1 more
Products
Debian Linux Fedora Enterprise Linux and 2 more
CVE-2023-52160

wpa_supplicant: potential authorization bypass

The implementation of PEAP in wpa_supplicant through 2.10 allows authentication bypass. For a successful attack, wpa_supplicant must be configured to not verify the network's TLS certificate during Phase 1 authentication, and an eap_peap_decrypt vulnerability can then be abused to skip Phase 2 authentication. The attack vector is sending an EAP-TLV Success packet instead of starting Phase 2. This allows an adversary to impersonate Enterprise Wi-Fi networks.

CVSS 3.1 · 6.5 Medium EPSS 1.2% KEV · Not listed
Vendors
Debian Fedoraproject Google and 3 more
Products
Debian Linux Fedora Android and 4 more
CVE-2022-23304

wpa_supplicant: EAP-pwd side-channel attacks as a result of cache access patterns

The implementations of EAP-pwd in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side-channel attacks as a result of cache access patterns. NOTE: this issue exists because of an incomplete fix for CVE-2019-9495.

CVSS 3.1 · 9.8 Critical EPSS 2.1% KEV · Not listed
Vendors
Fedoraproject W1.fi
Products
Fedora Hostapd Wpa Supplicant
CVE-2022-23303

wpa_supplicant: SAE side channel attacks as a result of cache access patterns

The implementations of SAE in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side channel attacks as a result of cache access patterns. NOTE: this issue exists because of an incomplete fix for CVE-2019-9494.

CVSS 3.1 · 9.8 Critical EPSS 3.3% KEV · Not listed
Vendors
Fedoraproject Redhat W1.fi
Products
Fedora Enterprise Linux Hostapd and 1 more
CVE-2017-13084

wpa_supplicant: reinstallation of the STK key in the PeerKey handshake

Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Station-To-Station-Link (STSL) Transient Key (STK) during the PeerKey handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.

CVSS 3.0 · 6.8 Medium EPSS 2.2% KEV · Not listed
Vendors
Canonical Debian Freebsd and 4 more
Products
Ubuntu Linux Debian Linux Freebsd and 9 more
CVE-2015-0210

wpa_supplicant: broken certificate subject check

wpa_supplicant 2.0-16 does not properly check certificate subject name, which allows remote attackers to cause a man-in-the-middle attack.

CVSS 3.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
W1.fi
Products
Wpa Supplicant
CVE-2017-13077

wpa_supplicant: Reinstallation of the pairwise key in the 4-way handshake

Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Pairwise Transient Key (PTK) Temporal Key (TK) during the four-way handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.

CVSS 3.0 · 6.8 Medium EPSS 2.4% KEV · Not listed
Vendors
Canonical Debian Freebsd and 4 more
Products
Ubuntu Linux Debian Linux Freebsd and 10 more
CVE-2017-13078

wpa_supplicant: Reinstallation of the group key in the 4-way handshake

Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the four-way handshake, allowing an attacker within radio range to replay frames from access points to clients.

CVSS 3.0 · 5.3 Medium EPSS 2.1% KEV · Not listed
Vendors
Canonical Debian Freebsd and 4 more
Products
Ubuntu Linux Debian Linux Freebsd and 10 more
CVE-2017-13079

wpa_supplicant: Reinstallation of the integrity group key in the 4-way handshake

Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11w allows reinstallation of the Integrity Group Temporal Key (IGTK) during the four-way handshake, allowing an attacker within radio range to spoof frames from access points to clients.

CVSS 3.0 · 5.3 Medium EPSS 2.1% KEV · Not listed
Vendors
Canonical Debian Freebsd and 4 more
Products
Ubuntu Linux Debian Linux Freebsd and 9 more
CVE-2017-13080

wpa_supplicant: Reinstallation of the group key in the group key handshake

Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the group key handshake, allowing an attacker within radio range to replay frames from access points to clients.

CVSS 3.0 · 5.3 Medium EPSS 2.3% KEV · Not listed
Vendors
Canonical Debian Freebsd and 4 more
Products
Ubuntu Linux Debian Linux Freebsd and 10 more
CVE-2017-13081

wpa_supplicant: Reinstallation of the integrity group key in the group key handshake

Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11w allows reinstallation of the Integrity Group Temporal Key (IGTK) during the group key handshake, allowing an attacker within radio range to spoof frames from access points to clients.

CVSS 3.0 · 5.3 Medium EPSS 2.0% KEV · Not listed
Vendors
Canonical Debian Freebsd and 4 more
Products
Ubuntu Linux Debian Linux Freebsd and 9 more
CVE-2017-13082

wpa_supplicant: Accepting a retransmitted FT Reassociation Request and reinstalling the pairwise key while processing it

Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11r allows reinstallation of the Pairwise Transient Key (PTK) Temporal Key (TK) during the fast BSS transmission (FT) handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.

CVSS 3.0 · 8.1 High EPSS 4.6% KEV · Not listed
Vendors
Canonical Debian Freebsd and 4 more
Products
Ubuntu Linux Debian Linux Freebsd and 10 more
CVE-2017-13086

wpa_supplicant: reinstallation of the Tunneled Direct-Link Setup (TDLS) PeerKey (TPK) key in the TDLS handshake

Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Tunneled Direct-Link Setup (TDLS) Peer Key (TPK) during the TDLS handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.

CVSS 3.0 · 6.8 Medium EPSS 2.0% KEV · Not listed
Vendors
Canonical Debian Freebsd and 4 more
Products
Ubuntu Linux Debian Linux Freebsd and 10 more
CVE-2017-13087

wpa_supplicant: reinstallation of the group key (GTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame

Wi-Fi Protected Access (WPA and WPA2) that support 802.11v allows reinstallation of the Group Temporal Key (GTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame, allowing an attacker within radio range to replay frames from access points to clients.

CVSS 3.0 · 5.3 Medium EPSS 1.7% KEV · Not listed
Vendors
Canonical Debian Freebsd and 4 more
Products
Ubuntu Linux Debian Linux Freebsd and 10 more
CVE-2017-13088

wpa_supplicant: reinstallation of the integrity group key (IGTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame

Wi-Fi Protected Access (WPA and WPA2) that support 802.11v allows reinstallation of the Integrity Group Temporal Key (IGTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame, allowing an attacker within radio range to replay frames from access points to clients.

CVSS 3.0 · 5.3 Medium EPSS 1.8% KEV · Not listed
Vendors
Canonical Debian Freebsd and 4 more
Products
Ubuntu Linux Debian Linux Freebsd and 10 more
CVE-2015-4144

hostapd: EAP-pwd missing payload length validation

The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 does not validate that a message is long enough to contain the Total-Length field, which allows remote attackers to cause a denial of service (crash) via a crafted message.

CVSS 2.0 · 5.0 Medium EPSS 3.4% KEV · Not listed
Vendors
Opensuse W1.fi
Products
Opensuse Hostapd Wpa Supplicant
CVE-2015-4143

hostapd: EAP-pwd missing payload length validation

The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted (1) Commit or (2) Confirm message payload.

CVSS 2.0 · 5.0 Medium EPSS 3.5% KEV · Not listed
Vendors
Opensuse W1.fi
Products
Opensuse Hostapd Wpa Supplicant
CVE-2015-4142

hostapd: integer underflow in AP mode WMM Action frame processing

Integer underflow in the WMM Action frame parser in hostapd 0.5.5 through 2.4 and wpa_supplicant 0.7.0 through 2.4, when used for AP mode MLME/SME functionality, allows remote attackers to cause a denial of service (crash) via a crafted frame, which triggers an out-of-bounds read.

CVSS 2.0 · 4.3 Medium EPSS 4.0% KEV · Not listed
Vendors
Opensuse Redhat W1.fi
Products
Opensuse Enterprise Linux Enterprise Linux Desktop and 5 more