6.8

CVE-2014-3686

wpa_supplicant and hostapd 0.7.2 through 2.2, when running with certain configurations and using wpa_cli or hostapd_cli with action scripts, allows remote attackers to execute arbitrary commands via a crafted frame.

Data is provided by the National Vulnerability Database (NVD)
W1.Fi ≫ Hostapd Version0.7.2
W1.Fi ≫ Hostapd Version1.0
W1.Fi ≫ Hostapd Version1.1
W1.Fi ≫ Hostapd Version2.0
W1.Fi ≫ Hostapd Version2.1
W1.Fi ≫ Hostapd Version2.2
W1.Fi ≫ Wpa Supplicant Version0.72
W1.Fi ≫ Wpa Supplicant Version1.0
W1.Fi ≫ Wpa Supplicant Version1.1
W1.Fi ≫ Wpa Supplicant Version2.0
W1.Fi ≫ Wpa Supplicant Version2.1
W1.Fi ≫ Wpa Supplicant Version2.2
Canonical ≫ Ubuntu Linux Version10.04 Update- Editionlts
Canonical ≫ Ubuntu Linux Version12.04 Update- Editionlts
Canonical ≫ Ubuntu Linux Version14.04 SwEditionlts
Debian ≫ Debian Linux Version6.0
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 4.67% 0.889
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.