Vulnerabilities > W1 FI > WPA Supplicant

DATE CVE VULNERABILITY TITLE RISK
2019-04-17 CVE-2019-9496 Improper Authentication vulnerability in multiple products
An invalid authentication sequence could result in the hostapd process terminating due to missing state validation steps when processing the SAE confirm message when in hostapd/AP mode.
network
low complexity
w1-fi fedoraproject CWE-287
7.5
2019-04-17 CVE-2019-9495 Information Exposure Through Discrepancy vulnerability in multiple products
The implementations of EAP-PWD in hostapd and wpa_supplicant are vulnerable to side-channel attacks as a result of cache access patterns.
3.7
2019-04-17 CVE-2019-9494 Information Exposure Through Discrepancy vulnerability in multiple products
The implementations of SAE in hostapd and wpa_supplicant are vulnerable to side channel attacks as a result of observable timing differences and cache access patterns.
5.9
2018-08-08 CVE-2018-14526 Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in multiple products
An issue was discovered in rsn_supp/wpa.c in wpa_supplicant 2.0 through 2.6.
low complexity
canonical debian w1-fi CWE-924
3.3
2018-02-21 CVE-2015-5316 NULL Pointer Dereference vulnerability in multiple products
The eap_pwd_perform_confirm_exchange function in eap_peer/eap_pwd.c in wpa_supplicant 2.x before 2.6, when EAP-pwd is enabled in a network configuration profile, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an EAP-pwd Confirm message followed by the Identity exchange.
network
w1-fi debian CWE-476
4.3
2018-02-21 CVE-2015-5315 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
The eap_pwd_process function in eap_peer/eap_pwd.c in wpa_supplicant 2.x before 2.6 does not validate that the reassembly buffer is large enough for the final fragment when EAP-pwd is enabled in a network configuration profile, which allows remote attackers to cause a denial of service (process termination) via a large final fragment in an EAP-pwd message.
network
w1-fi debian CWE-119
4.3
2018-02-21 CVE-2015-5314 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
The eap_pwd_process function in eap_server/eap_server_pwd.c in hostapd 2.x before 2.6 does not validate that the reassembly buffer is large enough for the final fragment when used with (1) an internal EAP server or (2) a RADIUS server and EAP-pwd is enabled in a runtime configuration, which allows remote attackers to cause a denial of service (process termination) via a large final fragment in an EAP-pwd message.
network
w1-fi debian CWE-119
4.3
2017-10-17 CVE-2017-13088 Use of Insufficiently Random Values vulnerability in multiple products
Wi-Fi Protected Access (WPA and WPA2) that support 802.11v allows reinstallation of the Integrity Group Temporal Key (IGTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame, allowing an attacker within radio range to replay frames from access points to clients.
2.9
2017-10-17 CVE-2017-13087 Use of Insufficiently Random Values vulnerability in multiple products
Wi-Fi Protected Access (WPA and WPA2) that support 802.11v allows reinstallation of the Group Temporal Key (GTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame, allowing an attacker within radio range to replay frames from access points to clients.
2.9
2017-10-17 CVE-2017-13086 Use of Insufficiently Random Values vulnerability in multiple products
Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Tunneled Direct-Link Setup (TDLS) Peer Key (TPK) during the TDLS handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.
5.4