Vulnerability-Lookup

CVE-2025-24912 (GCVE-0-2025-24912)

Vulnerability from cvelistv5 – Published: 2025-03-12 04:43 – Updated: 2025-03-12 13:21

Summary

hostapd fails to process crafted RADIUS packets properly. When hostapd authenticates wi-fi devices with RADIUS authentication, an attacker in the position between the hostapd and the RADIUS server may inject crafted RADIUS packets and force RADIUS authentications to fail.

Severity

3.7 (Low)


                        
                          CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-03-12 13:21 UTC

CWE

CWE-826 - Premature Release of Resource During Expected Lifetime

Assigner

jpcert jpcert root Scorecard

References

4 references

URL	Tags
https://w1.fi/hostapd/
https://w1.fi/cgit/hostap/commit/?id=726432d7622c…
https://w1.fi/cgit/hostap/commit/?id=339a334551ca…
https://jvn.jp/en/jp/JVN19358384/

Impacted products

1 product

Vendor	Product	Version	CPE status
Jouni Malinen	hostapd	Affected: 2.11 and earlier	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-24912",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-12T13:21:52.296145Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-12T13:21:59.254Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "hostapd",
          "vendor": "Jouni Malinen",
          "versions": [
            {
              "status": "affected",
              "version": "2.11 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "hostapd fails to process crafted RADIUS packets properly. When hostapd authenticates wi-fi devices with RADIUS authentication, an attacker in the position between the hostapd and the RADIUS server may inject crafted RADIUS packets and force RADIUS authentications to fail."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-826",
              "description": "Premature Release of Resource During Expected Lifetime",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-03-12T04:43:54.870Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://w1.fi/hostapd/"
        },
        {
          "url": "https://w1.fi/cgit/hostap/commit/?id=726432d7622cc0088ac353d073b59628b590ea44"
        },
        {
          "url": "https://w1.fi/cgit/hostap/commit/?id=339a334551ca911187cc870f4f97ef08e11db109"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN19358384/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2025-24912",
    "datePublished": "2025-03-12T04:43:54.870Z",
    "dateReserved": "2025-01-28T07:05:59.180Z",
    "dateUpdated": "2025-03-12T13:21:59.254Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-24912",
      "date": "2026-09-29",
      "epss": "0.0076",
      "percentile": "0.53494"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "hostapd",
                "vendor": "Jouni Malinen",
                "versions": [
                  {
                    "status": "affected",
                    "version": "2.11 and earlier"
                  }
                ]
              }
            ],
            "source": "vultures@jpcert.or.jp"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:w1.fi:hostapd:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2634D924-B17C-47D4-B6DE-F69736D79E54",
                    "versionEndIncluding": "2.11",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "hostapd fails to process crafted RADIUS packets properly. When hostapd authenticates wi-fi devices with RADIUS authentication, an attacker in the position between the hostapd and the RADIUS server may inject crafted RADIUS packets and force RADIUS authentications to fail."
          },
          {
            "lang": "es",
            "value": "hostapd no procesa correctamente los paquetes RADIUS manipulados. Cuando hostapd autentica dispositivos Wi-Fi con autenticaci\u00f3n RADIUS, un atacante ubicado entre hostapd y el servidor RADIUS podr\u00eda inyectar paquetes RADIUS manipulados y forzar el fallo de las autenticaciones RADIUS."
          }
        ],
        "id": "CVE-2025-24912",
        "lastModified": "2026-06-17T08:59:50.027",
        "metrics": {
          "cvssMetricV30": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 3.7,
                "baseSeverity": "LOW",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
                "version": "3.0"
              },
              "exploitabilityScore": 2.2,
              "impactScore": 1.4,
              "source": "vultures@jpcert.or.jp",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-24912",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-12T13:21:52.296145Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-03-12T05:15:37.430",
        "references": [
          {
            "source": "vultures@jpcert.or.jp",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://jvn.jp/en/jp/JVN19358384/"
          },
          {
            "source": "vultures@jpcert.or.jp",
            "tags": [
              "Patch"
            ],
            "url": "https://w1.fi/cgit/hostap/commit/?id=339a334551ca911187cc870f4f97ef08e11db109"
          },
          {
            "source": "vultures@jpcert.or.jp",
            "tags": [
              "Patch"
            ],
            "url": "https://w1.fi/cgit/hostap/commit/?id=726432d7622cc0088ac353d073b59628b590ea44"
          },
          {
            "source": "vultures@jpcert.or.jp",
            "tags": [
              "Product"
            ],
            "url": "https://w1.fi/hostapd/"
          }
        ],
        "sourceIdentifier": "vultures@jpcert.or.jp",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-826"
              }
            ],
            "source": "vultures@jpcert.or.jp",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-06-30T10:36:05+00:00",
      "cve": "CVE-2025-24912",
      "id": "CVE-2025-24912",
      "initial_release_date": "2025-03-12T04:43:54.870000+00:00",
      "product_status:known_affected": "3",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "hostapd: RADIUS Packet Processing Flaw in hostapd",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-24912.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "low",
      "current_release_date": "2026-08-31T00:21:59Z",
      "cve": "CVE-2025-24912",
      "id": "CVE-2025-24912",
      "initial_release_date": "2025-03-12T15:22:46Z",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "51",
      "product_status:recommended": "27",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-24912",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-24912.json",
      "version": "31"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-24912",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-03-12T13:21:52.296145Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-03-12T13:21:56.027Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "hostapd",
              "vendor": "Jouni Malinen",
              "versions": [
                {
                  "status": "affected",
                  "version": "2.11 and earlier"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "hostapd fails to process crafted RADIUS packets properly. When hostapd authenticates wi-fi devices with RADIUS authentication, an attacker in the position between the hostapd and the RADIUS server may inject crafted RADIUS packets and force RADIUS authentications to fail."
            }
          ],
          "metrics": [
            {
              "cvssV3_0": {
                "baseScore": 3.7,
                "baseSeverity": "LOW",
                "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
                "version": "3.0"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en-US",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-826",
                  "description": "Premature Release of Resource During Expected Lifetime",
                  "lang": "en-US",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-03-12T04:43:54.870Z",
            "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
            "shortName": "jpcert"
          },
          "references": [
            {
              "url": "https://w1.fi/hostapd/"
            },
            {
              "url": "https://w1.fi/cgit/hostap/commit/?id=726432d7622cc0088ac353d073b59628b590ea44"
            },
            {
              "url": "https://w1.fi/cgit/hostap/commit/?id=339a334551ca911187cc870f4f97ef08e11db109"
            },
            {
              "url": "https://jvn.jp/en/jp/JVN19358384/"
            }
          ]
        }
      },
      "cveMetadata": {
        "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "assignerShortName": "jpcert",
        "cveId": "CVE-2025-24912",
        "datePublished": "2025-03-12T04:43:54.870Z",
        "dateReserved": "2025-01-28T07:05:59.180Z",
        "dateUpdated": "2025-03-12T13:21:59.254Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2025-24912

Vulnerability from fkie_nvd - Published: 2025-03-12 05:15 - Updated: 2026-06-17 08:59

Severity

3.7 (Low) - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Summary

References

URL	Tags
vultures@jpcert.or.jp	https://jvn.jp/en/jp/JVN19358384/	Third Party Advisory
vultures@jpcert.or.jp	https://w1.fi/cgit/hostap/commit/?id=339a334551ca911187cc870f4f97ef08e11db109	Patch
vultures@jpcert.or.jp	https://w1.fi/cgit/hostap/commit/?id=726432d7622cc0088ac353d073b59628b590ea44	Patch
vultures@jpcert.or.jp	https://w1.fi/hostapd/	Product

Impacted products

	Vendor	Product	Version
	w1.fi	hostapd	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "hostapd",
          "vendor": "Jouni Malinen",
          "versions": [
            {
              "status": "affected",
              "version": "2.11 and earlier"
            }
          ]
        }
      ],
      "source": "vultures@jpcert.or.jp"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:w1.fi:hostapd:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "2634D924-B17C-47D4-B6DE-F69736D79E54",
              "versionEndIncluding": "2.11",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "hostapd fails to process crafted RADIUS packets properly. When hostapd authenticates wi-fi devices with RADIUS authentication, an attacker in the position between the hostapd and the RADIUS server may inject crafted RADIUS packets and force RADIUS authentications to fail."
    },
    {
      "lang": "es",
      "value": "hostapd no procesa correctamente los paquetes RADIUS manipulados. Cuando hostapd autentica dispositivos Wi-Fi con autenticaci\u00f3n RADIUS, un atacante ubicado entre hostapd y el servidor RADIUS podr\u00eda inyectar paquetes RADIUS manipulados y forzar el fallo de las autenticaciones RADIUS."
    }
  ],
  "id": "CVE-2025-24912",
  "lastModified": "2026-06-17T08:59:50.027",
  "metrics": {
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 3.7,
          "baseSeverity": "LOW",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "version": "3.0"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 1.4,
        "source": "vultures@jpcert.or.jp",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-24912",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-03-12T13:21:52.296145Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-03-12T05:15:37.430",
  "references": [
    {
      "source": "vultures@jpcert.or.jp",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://jvn.jp/en/jp/JVN19358384/"
    },
    {
      "source": "vultures@jpcert.or.jp",
      "tags": [
        "Patch"
      ],
      "url": "https://w1.fi/cgit/hostap/commit/?id=339a334551ca911187cc870f4f97ef08e11db109"
    },
    {
      "source": "vultures@jpcert.or.jp",
      "tags": [
        "Patch"
      ],
      "url": "https://w1.fi/cgit/hostap/commit/?id=726432d7622cc0088ac353d073b59628b590ea44"
    },
    {
      "source": "vultures@jpcert.or.jp",
      "tags": [
        "Product"
      ],
      "url": "https://w1.fi/hostapd/"
    }
  ],
  "sourceIdentifier": "vultures@jpcert.or.jp",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-826"
        }
      ],
      "source": "vultures@jpcert.or.jp",
      "type": "Secondary"
    }
  ]
}

GHSA-97X4-G54C-4PVM

Vulnerability from github – Published: 2025-03-12 06:32 – Updated: 2025-03-12 06:32

Details

Severity

3.7 (Low)


                  
                    CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-24912"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-826"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-03-12T05:15:37Z",
    "severity": "LOW"
  },
  "details": "hostapd fails to process crafted RADIUS packets properly. When hostapd authenticates wi-fi devices with RADIUS authentication, an attacker in the position between the hostapd and the RADIUS server may inject crafted RADIUS packets and force RADIUS authentications to fail.",
  "id": "GHSA-97x4-g54c-4pvm",
  "modified": "2025-03-12T06:32:42Z",
  "published": "2025-03-12T06:32:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24912"
    },
    {
      "type": "WEB",
      "url": "https://jvn.jp/en/jp/JVN19358384"
    },
    {
      "type": "WEB",
      "url": "https://w1.fi/cgit/hostap/commit/?id=339a334551ca911187cc870f4f97ef08e11db109"
    },
    {
      "type": "WEB",
      "url": "https://w1.fi/cgit/hostap/commit/?id=726432d7622cc0088ac353d073b59628b590ea44"
    },
    {
      "type": "WEB",
      "url": "https://w1.fi/hostapd"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ]
}

JVNDB-2025-000017

Vulnerability from jvndb - Published: 2025-03-12 05:19 - Updated:2025-03-12 05:19

Severity

3.7 (Low) - cvssV3_0 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Summary

hostapd vulnerable to improper processing of RADIUS packets

Details

hostapd provided by Jouni Malinen fails to process crafted RADIUS packets properly (CWE-826). KUSABA Takeshi of Internet Initiative Japan Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

References

Type

URL

	JVN	https://jvn.jp/en/jp/JVN19358384/index.html
	CVE	https://www.cve.org/CVERecord?id=CVE-2025-24912
	No Mapping(CWE-Other)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

Vendor

Product

Jouni Malinen

hostapd

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2025/JVNDB-2025-000017.html",
  "dc:date": "2025-03-12T14:19+09:00",
  "dcterms:issued": "2025-03-12T14:19+09:00",
  "dcterms:modified": "2025-03-12T14:19+09:00",
  "description": "hostapd provided by Jouni Malinen fails to process crafted RADIUS packets properly (CWE-826).\r\n\r\nKUSABA Takeshi of Internet Initiative Japan Inc. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2025/JVNDB-2025-000017.html",
  "sec:cpe": {
    "#text": "cpe:/a:misc:jouni_malinen_hostapd",
    "@product": "hostapd",
    "@vendor": "Jouni Malinen",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "3.7",
    "@severity": "Low",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2025-000017",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN19358384/index.html",
      "@id": "JVN#19358384",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2025-24912",
      "@id": "CVE-2025-24912",
      "@source": "CVE"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "hostapd vulnerable to improper processing of RADIUS packets"
}

MSRC_CVE-2025-24912

Vulnerability from csaf_microsoft - Published: 2025-03-02 00:00 - Updated: 2026-02-21 02:29

Summary

Scope

1 vulnerability in this advisory, including CVE-2025-24912.

CVE-2025-24912

3.7 (Low)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Fixed: 2 products Known affected: 2 products

https://learn.microsoft.com/en-us/azure/azure-linux/tutoria…

Open the full advisory

OESA-2026-1438 (CVE-2025-24912)

Vulnerability from osv_openeuler – Published: 2026-02-28 11:10 – Updated: 2026-08-06 11:10 – Source website

Summary

wpa_supplicant security update

Details

wpa_supplicant is a WPA Supplicant for Linux, BSD, Mac OS X, and Windows with support for WPA and WPA2 (IEEE 802.11i / RSN). It is suitable for both desktop/laptop computers and embedded systems. Supplicant is the IEEE 802.1X/WPA component that is used in the client stations. It implements key negotiation with a WPA Authenticator and it controls the roaming and IEEE 802.11 authentication/association of the wlan driver.

Security Fix(es):

Severity

3.7 (Low)


                    
                      CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-24912	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "wpa_supplicant-2.6-33.oe2203sp4.aarch64.rpm",
          "wpa_supplicant-debuginfo-2.6-33.oe2203sp4.aarch64.rpm",
          "wpa_supplicant-debugsource-2.6-33.oe2203sp4.aarch64.rpm",
          "wpa_supplicant-gui-2.6-33.oe2203sp4.aarch64.rpm",
          "wpa_supplicant-help-2.6-33.oe2203sp4.aarch64.rpm"
        ],
        "src": [
          "wpa_supplicant-2.6-33.oe2203sp4.src.rpm"
        ],
        "x86_64": [
          "wpa_supplicant-2.6-33.oe2203sp4.x86_64.rpm",
          "wpa_supplicant-debuginfo-2.6-33.oe2203sp4.x86_64.rpm",
          "wpa_supplicant-debugsource-2.6-33.oe2203sp4.x86_64.rpm",
          "wpa_supplicant-gui-2.6-33.oe2203sp4.x86_64.rpm",
          "wpa_supplicant-help-2.6-33.oe2203sp4.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:22.03-LTS-SP4",
        "name": "wpa_supplicant",
        "purl": "pkg:rpm/openEuler/wpa_supplicant\u0026distro=openEuler-22.03-LTS-SP4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.6-33.oe2203sp4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "Low"
  },
  "details": "wpa_supplicant is a WPA Supplicant for Linux, BSD, Mac OS X, and Windows with support for WPA and WPA2 (IEEE 802.11i / RSN). It is suitable for both desktop/laptop computers and embedded systems. Supplicant is the IEEE 802.1X/WPA component that is used in the client stations. It implements key negotiation with a WPA Authenticator and it controls the roaming and IEEE 802.11 authentication/association of the wlan driver.\r\n\r\nSecurity Fix(es):\n\nhostapd fails to process crafted RADIUS packets properly. When hostapd authenticates wi-fi devices with RADIUS authentication, an attacker in the position between the hostapd and the RADIUS server may inject crafted RADIUS packets and force RADIUS authentications to fail.(CVE-2025-24912)",
  "id": "OESA-2026-1438",
  "modified": "2026-08-06T11:10:27Z",
  "published": "2026-02-28T11:10:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1438"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24912"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "wpa_supplicant security update",
  "upstream": [
    "CVE-2025-24912"
  ]
}

OESA-2026-1439 (CVE-2025-24912)

Vulnerability from osv_openeuler – Published: 2026-02-28 11:10 – Updated: 2026-08-06 11:10 – Source website

Summary

wpa_supplicant security update

Details

Security Fix(es):

Severity

3.7 (Low)


                    
                      CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-24912	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "wpa_supplicant-2.10-8.oe2403.aarch64.rpm",
          "wpa_supplicant-debuginfo-2.10-8.oe2403.aarch64.rpm",
          "wpa_supplicant-debugsource-2.10-8.oe2403.aarch64.rpm",
          "wpa_supplicant-gui-2.10-8.oe2403.aarch64.rpm",
          "wpa_supplicant-help-2.10-8.oe2403.aarch64.rpm"
        ],
        "src": [
          "wpa_supplicant-2.10-8.oe2403.src.rpm"
        ],
        "x86_64": [
          "wpa_supplicant-2.10-8.oe2403.x86_64.rpm",
          "wpa_supplicant-debuginfo-2.10-8.oe2403.x86_64.rpm",
          "wpa_supplicant-debugsource-2.10-8.oe2403.x86_64.rpm",
          "wpa_supplicant-gui-2.10-8.oe2403.x86_64.rpm",
          "wpa_supplicant-help-2.10-8.oe2403.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS",
        "name": "wpa_supplicant",
        "purl": "pkg:rpm/openEuler/wpa_supplicant\u0026distro=openEuler-24.03-LTS"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.10-8.oe2403"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "Low"
  },
  "details": "wpa_supplicant is a WPA Supplicant for Linux, BSD, Mac OS X, and Windows with support for WPA and WPA2 (IEEE 802.11i / RSN). It is suitable for both desktop/laptop computers and embedded systems. Supplicant is the IEEE 802.1X/WPA component that is used in the client stations. It implements key negotiation with a WPA Authenticator and it controls the roaming and IEEE 802.11 authentication/association of the wlan driver.\r\n\r\nSecurity Fix(es):\n\nhostapd fails to process crafted RADIUS packets properly. When hostapd authenticates wi-fi devices with RADIUS authentication, an attacker in the position between the hostapd and the RADIUS server may inject crafted RADIUS packets and force RADIUS authentications to fail.(CVE-2025-24912)",
  "id": "OESA-2026-1439",
  "modified": "2026-08-06T11:10:27Z",
  "published": "2026-02-28T11:10:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1439"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24912"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "wpa_supplicant security update",
  "upstream": [
    "CVE-2025-24912"
  ]
}

OESA-2026-3177 (CVE-2025-24912)

Vulnerability from osv_openeuler – Published: 2026-07-24 11:12 – Updated: 2026-08-06 11:12 – Source website

Summary

wpa_supplicant security update

Details

Security Fix(es):

Severity

3.7 (Low)


                    
                      CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-24912	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "wpa_supplicant-2.11-8.oe2403sp1.aarch64.rpm",
          "wpa_supplicant-debuginfo-2.11-8.oe2403sp1.aarch64.rpm",
          "wpa_supplicant-debugsource-2.11-8.oe2403sp1.aarch64.rpm",
          "wpa_supplicant-gui-2.11-8.oe2403sp1.aarch64.rpm"
        ],
        "noarch": [
          "wpa_supplicant-help-2.11-8.oe2403sp1.noarch.rpm"
        ],
        "src": [
          "wpa_supplicant-2.11-8.oe2403sp1.src.rpm"
        ],
        "x86_64": [
          "wpa_supplicant-2.11-8.oe2403sp1.x86_64.rpm",
          "wpa_supplicant-debuginfo-2.11-8.oe2403sp1.x86_64.rpm",
          "wpa_supplicant-debugsource-2.11-8.oe2403sp1.x86_64.rpm",
          "wpa_supplicant-gui-2.11-8.oe2403sp1.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP1",
        "name": "wpa_supplicant",
        "purl": "pkg:rpm/openEuler/wpa_supplicant\u0026distro=openEuler-24.03-LTS-SP1"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.11-8.oe2403sp1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "Low"
  },
  "details": "wpa_supplicant is a WPA Supplicant for Linux, BSD, Mac OS X, and Windows with support for WPA and WPA2 (IEEE 802.11i / RSN). It is suitable for both desktop/laptop computers and embedded systems. Supplicant is the IEEE 802.1X/WPA component that is used in the client stations. It implements key negotiation with a WPA Authenticator and it controls the roaming and IEEE 802.11 authentication/association of the wlan driver.\r\n\r\nSecurity Fix(es):\n\nhostapd fails to process crafted RADIUS packets properly. When hostapd authenticates wi-fi devices with RADIUS authentication, an attacker in the position between the hostapd and the RADIUS server may inject crafted RADIUS packets and force RADIUS authentications to fail.(CVE-2025-24912)",
  "id": "OESA-2026-3177",
  "modified": "2026-08-06T11:12:03Z",
  "published": "2026-07-24T11:12:03Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3177"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24912"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "wpa_supplicant security update",
  "upstream": [
    "CVE-2025-24912"
  ]
}

OPENSUSE-SU-2025:14890-1

Vulnerability from csaf_opensuse - Published: 2025-03-13 00:00 - Updated: 2026-09-20 21:29

Summary

hostapd-2.11-2.1 on GA media

Severity

Moderate

Scope

2 vulnerabilities in this advisory, including CVE-2025-24912.

CVE-2025-24912

3.7 (Low)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Recommended: 4 products

Open the full advisory

OPENSUSE-SU-2025:14899-1

Vulnerability from csaf_opensuse - Published: 2025-03-16 00:00 - Updated: 2026-09-20 21:29

Summary

wpa_supplicant-2.11-4.1 on GA media

Severity

Moderate

Scope

1 vulnerability in this advisory, including CVE-2025-24912.

CVE-2025-24912

3.7 (Low)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Recommended: 8 products

Open the full advisory

OPENSUSE-SU-2026:20985-1

Vulnerability from csaf_opensuse - Published: 2026-06-15 13:55 - Updated: 2026-09-17 17:35

Summary

Security update for hostapd

Severity

Moderate

Scope

1 vulnerability in this advisory, including CVE-2025-24912.

CVE-2025-24912

3.7 (Low)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Recommended: 4 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2025-24912 (GCVE-0-2025-24912)

FKIE_CVE-2025-24912

GHSA-97X4-G54C-4PVM

JVNDB-2025-000017

MSRC_CVE-2025-24912

OESA-2026-1438 (CVE-2025-24912)

OESA-2026-1439 (CVE-2025-24912)

OESA-2026-3177 (CVE-2025-24912)

OPENSUSE-SU-2025:14890-1

OPENSUSE-SU-2025:14899-1

OPENSUSE-SU-2026:20985-1

Tags

Sightings

Nomenclature

Related by attack behaviour