CVE-2019-9495CWE-524

CVE-2019-9495: vulnerability in Wi-Fi Alliance wpa_supplicant with EAP-pwd…

The implementations of EAP-PWD in hostapd and wpa_supplicant are vulnerable to side-channel attacks as a result of cache access patterns

Published · Updated

Follow this CVE+ Monitor hostapd with EAP-pwd support+ Monitor wpa supplicant with EAP-pwd support

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 3.5%
The implementations of EAP-PWD in hostapd and wpa_supplicant are vulnerable to side-channel attacks as a result of cache access patterns. All versions of hostapd and wpa_supplicant with EAP-PWD support are vulnerable. The ability to install and execute applications is necessary for a successful attack. Memory access patterns are visible in a shared cache. Weak passwords may be cracked. Versions of hostapd/wpa_supplicant 2.7 and newer, are not vulnerable to the timing attack described in CVE-2019-9494. Both hostapd with EAP-pwd support and wpa_supplicant with EAP-pwd support prior to and including version 2.7 are affected.
Affected products
Wi-Fi Alliance · hostapd with EAP-pwd supportWi-Fi Alliance · wpa_supplicant with EAP-pwd support
Related CVEs — Wi-Fi Alliance wpa_supplicant with EAP-pwd…

In the same product, most dangerous first.

CVE-2019-9497—The implementations of EAP-PWD in hostapd EAP Server and wpa_supplicant EAP Peer do not validate the scalar and element values in EAP-pwd-CommitEPSS 5.0%CVE-2019-9499—The implementations of EAP-PWD in wpa_supplicant EAP Peer do not validate the scalar and element values in EAP-pwd-CommitEPSS 2.2%CVE-2019-9498—The implementations of EAP-PWD in hostapd EAP Server do not validate the scalar and element values in EAP-pwd-CommitEPSS 2.2%