HO
Product
hostapd
41
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 10Medium 17Low 2
Watch
Add hostapd to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-9499 | 8.1 | Apr 17 | The implementations of EAP-PWD in wpa_supplicant EAP Peer, when built against a crypto library missing explicit validation on imported elements, do not validate the scalar and… Affected: through 2.4; 2.5 through 2.7 |
| CVE-2019-9498 | 8.1 | Apr 17 | The implementations of EAP-PWD in hostapd EAP Server, when built against a crypto library missing explicit validation on imported elements, do not validate the scalar and element… Affected: through 2.4; 2.5 through 2.7 |
| CVE-2019-9497 | 8.1 | Apr 17 | The implementations of EAP-PWD in hostapd EAP Server and wpa_supplicant EAP Peer do not validate the scalar and element values in EAP-pwd-Commit Affected: through 2.4; 2.5 through 2.7 |
| CVE-2017-13082 | 8.1 | Oct 17 | Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11r allows reinstallation of the Pairwise Transient Key (PTK) Temporal Key (TK) during the fast BSS transmission (FT)… Affected: 0.2.4; 0.2.5; 0.2.6; 0.2.8; 0.3.7; 0.3.9; +25 more |
| CVE-2020-12695 | 7.5 | Jun 8 | The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different network segment… Affected: before 2.0.0 |
| CVE-2019-10064 | 7.5 | Feb 28 | hostapd before 2.6, in EAP mode, makes calls to the rand() and random() standard library functions without any preceding srand() or srandom() call, which results in inappropriate… Affected: before 2.6 |
| CVE-2019-9496 | 7.5 | Apr 17 | An invalid authentication sequence could result in the hostapd process terminating due to missing state validation steps when processing the SAE confirm message when in hostapd/AP… Affected: through 2.7 |
| CVE-2016-10743 | 7.5 | Mar 23 | hostapd before 2.6 does not prevent use of the low-quality PRNG that is reached by an os_random() function call Affected: before 2.6 |
| CVE-2016-4476 | 7.5 | May 9 | hostapd 0.6.7 through 2.5 and wpa_supplicant 0.6.7 through 2.5 do not reject \n and \r characters in passphrase parameters, which allows remote attackers to cause a denial of… Affected: 0.6.7 through 2.5 |
| CVE-2026-58374 | 7.1 | Jun 30 | In hostapd before 2.12, a missing bounds check in AP-mode Wi-Fi 7 (IEEE 802.11be) Multi-Link Operation (MLO) association request processing allows an unauthenticated attacker… Affected: before 2.12 |
Showing 10