CVE-2025-24912

<= 2.11

hostapd fails to process crafted RADIUS packets properly. When hostapd authenticates wi-fi devices with RADIUS authentication, an

3.7LOW

CVE-2022-37660

<= 2.10

In hostapd 2.10 and earlier, the PKEX code remains active even after a successful PKEX association. An attacker that successfully

6.5MEDIUM

CVE-2022-23304

< 2.10

The implementations of EAP-pwd in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side-channel attacks as a r

9.8CRITICAL

CVE-2022-23303

< 2.10

The implementations of SAE in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side channel attacks as a resul

9.8CRITICAL

CVE-2021-30004

all versions

In wpa_supplicant and hostapd 2.9, forging attacks may occur because AlgorithmIdentifier parameters are mishandled in tls/pkcs1.c

5.3MEDIUM

CVE-2020-12695

< 2.0.0

The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request wit

7.5HIGH

CVE-2019-10064

< 2.6

hostapd before 2.6, in EAP mode, makes calls to the rand() and random() standard library functions without any preceding srand() o

7.5HIGH

CVE-2019-5062

all versions

An exploitable denial-of-service vulnerability exists in the 802.11w security state handling for hostapd 2.6 connected clients wit

6.5MEDIUM

CVE-2019-5061

all versions

An exploitable denial-of-service vulnerability exists in the hostapd 2.6, where an attacker could trigger AP to send IAPP location

6.5MEDIUM

CVE-2019-16275

<= 2.9

hostapd before 2.10 and wpa_supplicant before 2.10 allow an incorrect indication of disconnection in certain situations because so

6.5MEDIUM

CVE-2019-13377

>= 2.0 and <= 2.8

The implementations of SAE and EAP-pwd in hostapd and wpa_supplicant 2.x through 2.8 are vulnerable to side-channel attacks as a r

5.9MEDIUM

CVE-2019-11555

< 2.8

The EAP-pwd implementation in hostapd (EAP server) before 2.8 and wpa_supplicant (EAP peer) before 2.8 does not validate fragmenta

5.9MEDIUM

CVE-2019-9499

<= 2.4

The implementations of EAP-PWD in wpa_supplicant EAP Peer, when built against a crypto library missing explicit validation on impo

8.1HIGH

CVE-2019-9498

<= 2.4

The implementations of EAP-PWD in hostapd EAP Server, when built against a crypto library missing explicit validation on imported

8.1HIGH

CVE-2019-9497

<= 2.4

The implementations of EAP-PWD in hostapd EAP Server and wpa_supplicant EAP Peer do not validate the scalar and element values in

8.1HIGH

CVE-2019-9496

<= 2.7

An invalid authentication sequence could result in the hostapd process terminating due to missing state validation steps when proc

7.5HIGH

CVE-2019-9495

<= 2.7

The implementations of EAP-PWD in hostapd and wpa_supplicant are vulnerable to side-channel attacks as a result of cache access pa

3.7LOW

CVE-2019-9494

<= 2.7

The implementations of SAE in hostapd and wpa_supplicant are vulnerable to side channel attacks as a result of observable timing d

5.9MEDIUM

CVE-2016-10743

< 2.6

hostapd before 2.6 does not prevent use of the low-quality PRNG that is reached by an os_random() function call.

7.5HIGH

CVE-2017-13088

all versions

Wi-Fi Protected Access (WPA and WPA2) that support 802.11v allows reinstallation of the Integrity Group Temporal Key (IGTK) when p

5.3MEDIUM

CVE-2017-13087

all versions

Wi-Fi Protected Access (WPA and WPA2) that support 802.11v allows reinstallation of the Group Temporal Key (GTK) when processing a

5.3MEDIUM

CVE-2017-13086

all versions

Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Tunneled Direct-Link Setup (TDLS) Peer Key (TPK) during the TDL

6.8MEDIUM

CVE-2017-13084

all versions

Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Station-To-Station-Link (STSL) Transient Key (STK) during the P

6.8MEDIUM

CVE-2017-13082

all versions

Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11r allows reinstallation of the Pairwise Transient Key (PTK) Tempora

8.1HIGH

CVE-2017-13081

all versions

Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11w allows reinstallation of the Integrity Group Temporal Key (IGTK)

5.3MEDIUM

CVE-2017-13080

all versions

Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the group key handshake, allowi

5.3MEDIUM

CVE-2017-13079

all versions

Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11w allows reinstallation of the Integrity Group Temporal Key (IGTK)

5.3MEDIUM

CVE-2017-13078

all versions

Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the four-way handshake, allowin

5.3MEDIUM

CVE-2017-13077

all versions

Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Pairwise Transient Key (PTK) Temporal Key (TK) during the four-

6.8MEDIUM

CVE-2016-4476

>= 0.6.7 and <= 2.5

hostapd 0.6.7 through 2.5 and wpa_supplicant 0.6.7 through 2.5 do not reject \n and \r characters in passphrase parameters, which

7.5HIGH

CVE-2015-8041

<= 2.4

Multiple integer overflows in the NDEF record parser in hostapd before 2.5 and wpa_supplicant before 2.5 allow remote attackers to

CVE-2015-4146

all versions

The EAP-pwd peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 does not clear the L (Length) and M (More) flags bef

CVE-2015-4145

all versions

The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 does not validate a fragment is already b

CVE-2015-4144

all versions

The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 does not validate that a message is long

CVE-2015-4143

all versions

The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 allows remote attackers to cause a denial

CVE-2015-4142

all versions

Integer underflow in the WMM Action frame parser in hostapd 0.5.5 through 2.4 and wpa_supplicant 0.7.0 through 2.4, when used for

CVE-2015-4141

all versions

The WPS UPnP function in hostapd, when using WPS AP, and wpa_supplicant, when using WPS external registrar (ER), 0.7.0 through 2.4

CVE-2014-3686

all versions

wpa_supplicant and hostapd 0.7.2 through 2.2, when running with certain configurations and using wpa_cli or hostapd_cli with actio

CVE-2012-4445

all versions

Heap-based buffer overflow in the eap_server_tls_process_fragment function in eap_server_tls_common.c in the EAP authentication se

CVE-2012-2389

all versions

hostapd 0.7.3, and possibly other versions before 1.0, uses 0644 permissions for /etc/hostapd/hostapd.conf, which might allow loca

CVE-2006-2213

all versions

Hostapd 0.3.7-2 allows remote attackers to cause a denial of service (segmentation fault) via an unspecified value in the key_data