Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 51

Export CSV
CVE-2026-78807

wpa_supplicant: wpa_supplicant: Security bypass via missing PMKSA validation

An issue in wpa_supplicant all versions before v.2.12 allows a local attacker to bypass proper network context and AKMP matching for PMKSA caching via missing validation in the driver based PMKSA selection path in wpa.c

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
W1.fi
Products
Wpa Supplicant
CVE-2021-30004

wpa_supplicant: mishandled AlgorithmIdentifier parameters may lead to forging attacks

In wpa_supplicant and hostapd 2.9, forging attacks may occur because AlgorithmIdentifier parameters are mishandled in tls/pkcs1.c and tls/x509v3.c.

CVSS 3.1 · 4.3 Medium EPSS 1.6% KEV · Not listed
Vendors
W1.fi
Products
Hostapd Wpa Supplicant
CVE-2026-58374

hostapd: hostapd: Denial of Service via malformed Wi-Fi 7 Multi-Link Operation association request

In hostapd before 2.12, a missing bounds check in AP-mode Wi-Fi 7 (IEEE 802.11be) Multi-Link Operation (MLO) association request processing allows an unauthenticated attacker within wireless range to send a crafted management frame containing a malformed Multi-Link Element or Per-STA Profile subelement. In hostapd_process_ml_assoc_req() in src/ap/ieee802_11_eht.c, the received link_id field can be parsed as value 15, but the corresponding links[] storage only has valid entries for lower link IDs (0 through 14). This causes an out-of-bounds write / small memory corruption during association processing before the 4-way handshake. The attack does not require network credentials, prior authentication, or user interaction. The confirmed practical impact is denial of service through hostapd process termination. This affects hostapd v2.11 and newer development snapshots before v2.12 when built with CONFIG_IEEE80211BE enabled. The issue is fixed in hostapd v2.12 and the upstream 2026-1 fixes.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
W1.fi
Products
Hostapd
CVE-2021-27803

wpa_supplicant: Use-after-free in P2P provision discovery processing

A vulnerability was discovered in how p2p/p2p_pd.c in wpa_supplicant before 2.10 processes P2P (Wi-Fi Direct) provision discovery requests. It could result in denial of service or other impact (potentially execution of arbitrary code), for an attacker within radio range.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed
Vendors
Debian Fedoraproject Redhat and 1 more
Products
Debian Linux Fedora Enterprise Linux and 2 more
CVE-2023-52160

wpa_supplicant: potential authorization bypass

The implementation of PEAP in wpa_supplicant through 2.10 allows authentication bypass. For a successful attack, wpa_supplicant must be configured to not verify the network's TLS certificate during Phase 1 authentication, and an eap_peap_decrypt vulnerability can then be abused to skip Phase 2 authentication. The attack vector is sending an EAP-TLV Success packet instead of starting Phase 2. This allows an adversary to impersonate Enterprise Wi-Fi networks.

CVSS 3.1 · 6.5 Medium EPSS 1.2% KEV · Not listed
Vendors
Debian Fedoraproject Google and 3 more
Products
Debian Linux Fedora Android and 4 more
CVE-2022-37660

hostapd: Public Key Exchange (PKEX) Reuse Vulnerability in hostapd

In hostapd 2.10 and earlier, the PKEX code remains active even after a successful PKEX association. An attacker that successfully bootstrapped public keys with another entity using PKEX in the past, will be able to subvert a future bootstrapping by passively observing public keys, re-using the encrypting element Qi and subtracting it from the captured message M (X = M - Qi). This will result in the public ephemeral key X; the only element required to subvert the PKEX association.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Hostapd W1.fi
Products
Hostapd Hostapd
CVE-2022-23304

wpa_supplicant: EAP-pwd side-channel attacks as a result of cache access patterns

The implementations of EAP-pwd in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side-channel attacks as a result of cache access patterns. NOTE: this issue exists because of an incomplete fix for CVE-2019-9495.

CVSS 3.1 · 9.8 Critical EPSS 2.1% KEV · Not listed
Vendors
Fedoraproject W1.fi
Products
Fedora Hostapd Wpa Supplicant
CVE-2022-23303

wpa_supplicant: SAE side channel attacks as a result of cache access patterns

The implementations of SAE in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side channel attacks as a result of cache access patterns. NOTE: this issue exists because of an incomplete fix for CVE-2019-9494.

CVSS 3.1 · 9.8 Critical EPSS 3.3% KEV · Not listed
Vendors
Fedoraproject Redhat W1.fi
Products
Fedora Enterprise Linux Hostapd and 1 more
CVE-2025-24912

hostapd: RADIUS Packet Processing Flaw in hostapd

hostapd fails to process crafted RADIUS packets properly. When hostapd authenticates wi-fi devices with RADIUS authentication, an attacker in the position between the hostapd and the RADIUS server may inject crafted RADIUS packets and force RADIUS authentications to fail.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
W1.fi
Products
Hostapd
CVE-2017-13080

wpa_supplicant: Reinstallation of the group key in the group key handshake

Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the group key handshake, allowing an attacker within radio range to replay frames from access points to clients.

CVSS 3.0 · 5.3 Medium EPSS 2.3% KEV · Not listed
Vendors
Canonical Debian Freebsd and 4 more
Products
Ubuntu Linux Debian Linux Freebsd and 10 more
CVE-2017-13086

wpa_supplicant: reinstallation of the Tunneled Direct-Link Setup (TDLS) PeerKey (TPK) key in the TDLS handshake

Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Tunneled Direct-Link Setup (TDLS) Peer Key (TPK) during the TDLS handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.

CVSS 3.0 · 6.8 Medium EPSS 2.0% KEV · Not listed
Vendors
Canonical Debian Freebsd and 4 more
Products
Ubuntu Linux Debian Linux Freebsd and 10 more
CVE-2017-13081

wpa_supplicant: Reinstallation of the integrity group key in the group key handshake

Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11w allows reinstallation of the Integrity Group Temporal Key (IGTK) during the group key handshake, allowing an attacker within radio range to spoof frames from access points to clients.

CVSS 3.0 · 5.3 Medium EPSS 2.0% KEV · Not listed
Vendors
Canonical Debian Freebsd and 4 more
Products
Ubuntu Linux Debian Linux Freebsd and 9 more
CVE-2017-13079

wpa_supplicant: Reinstallation of the integrity group key in the 4-way handshake

Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11w allows reinstallation of the Integrity Group Temporal Key (IGTK) during the four-way handshake, allowing an attacker within radio range to spoof frames from access points to clients.

CVSS 3.0 · 5.3 Medium EPSS 2.1% KEV · Not listed
Vendors
Canonical Debian Freebsd and 4 more
Products
Ubuntu Linux Debian Linux Freebsd and 9 more
CVE-2017-13087

wpa_supplicant: reinstallation of the group key (GTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame

Wi-Fi Protected Access (WPA and WPA2) that support 802.11v allows reinstallation of the Group Temporal Key (GTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame, allowing an attacker within radio range to replay frames from access points to clients.

CVSS 3.0 · 5.3 Medium EPSS 1.7% KEV · Not listed
Vendors
Canonical Debian Freebsd and 4 more
Products
Ubuntu Linux Debian Linux Freebsd and 10 more
CVE-2017-13082

wpa_supplicant: Accepting a retransmitted FT Reassociation Request and reinstalling the pairwise key while processing it

Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11r allows reinstallation of the Pairwise Transient Key (PTK) Temporal Key (TK) during the fast BSS transmission (FT) handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.

CVSS 3.0 · 8.1 High EPSS 4.6% KEV · Not listed
Vendors
Canonical Debian Freebsd and 4 more
Products
Ubuntu Linux Debian Linux Freebsd and 10 more
CVE-2015-0210

wpa_supplicant: broken certificate subject check

wpa_supplicant 2.0-16 does not properly check certificate subject name, which allows remote attackers to cause a man-in-the-middle attack.

CVSS 3.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
W1.fi
Products
Wpa Supplicant
CVE-2017-13077

wpa_supplicant: Reinstallation of the pairwise key in the 4-way handshake

Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Pairwise Transient Key (PTK) Temporal Key (TK) during the four-way handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.

CVSS 3.0 · 6.8 Medium EPSS 2.4% KEV · Not listed
Vendors
Canonical Debian Freebsd and 4 more
Products
Ubuntu Linux Debian Linux Freebsd and 10 more
CVE-2017-13078

wpa_supplicant: Reinstallation of the group key in the 4-way handshake

Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the four-way handshake, allowing an attacker within radio range to replay frames from access points to clients.

CVSS 3.0 · 5.3 Medium EPSS 2.1% KEV · Not listed
Vendors
Canonical Debian Freebsd and 4 more
Products
Ubuntu Linux Debian Linux Freebsd and 10 more
CVE-2017-13084

wpa_supplicant: reinstallation of the STK key in the PeerKey handshake

Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Station-To-Station-Link (STSL) Transient Key (STK) during the PeerKey handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.

CVSS 3.0 · 6.8 Medium EPSS 2.2% KEV · Not listed
Vendors
Canonical Debian Freebsd and 4 more
Products
Ubuntu Linux Debian Linux Freebsd and 9 more
CVE-2017-13088

wpa_supplicant: reinstallation of the integrity group key (IGTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame

Wi-Fi Protected Access (WPA and WPA2) that support 802.11v allows reinstallation of the Integrity Group Temporal Key (IGTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame, allowing an attacker within radio range to replay frames from access points to clients.

CVSS 3.0 · 5.3 Medium EPSS 1.8% KEV · Not listed
Vendors
Canonical Debian Freebsd and 4 more
Products
Ubuntu Linux Debian Linux Freebsd and 10 more