An invalid authentication sequence could result in the hostapd process terminating due to missing state validation steps when processing the SAE confirm message when in hostapd/AP mode. All version of hostapd with SAE support are vulnerable. An attacker may force the hostapd process to terminate, performing a denial of service attack. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.7 are affected.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade hostapdUpgrade wpa_supplicant | Jun 21, 2019 | Apr 17, 2019 |
| Debian | — | Upgrade wpa | Jul 30, 2024 | Apr 17, 2019 |
| Freebsd | — | Upgrade hostapdUpgrade FreeBSDUpgrade wpa_supplicant | Apr 23, 2019 | Apr 23, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade wpa_supplicant | Apr 30, 2021 | Apr 17, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade wpa_supplicant | Sep 12, 2019 | Apr 17, 2019 |
| Suse | — | Upgrade hostapd | Feb 16, 2020 | Apr 17, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 17, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub