The EAP-PWD module in FreeRADIUS 3.0 through 3.0.8 allows remote attackers to have unspecified impact via a crafted (1) commit or (2) confirm message, which triggers an out-of-bounds read.
CVSS Details
- CVSS 3.0 Base Score: 8.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 4, 2015 |
| Suse | — | Upgrade freeradius-server-krb5Upgrade freeradius-server-mysqlUpgrade freeradius-server-perlUpgrade freeradius-server-python3Upgrade freeradius-server-pythonUpgrade freeradius-serverUpgrade freeradius-server-sqliteUpgrade freeradius-server-postgresqlUpgrade freeradius-server-docUpgrade freeradius-server-develUpgrade freeradius-server-libsUpgrade freeradius-server-ldapUpgrade freeradius-server-utils | Jul 21, 2017 | Mar 27, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub