8.1
CVE-2019-9499
- EPSS 1.06%
- Published 17.04.2019 14:29:04
- Last modified 21.11.2024 04:51:44
- Source cret@cert.org
- Teams watchlist Login
- Open Login
The implementations of EAP-PWD in wpa_supplicant EAP Peer, when built against a crypto library missing explicit validation on imported elements, do not validate the scalar and element values in EAP-pwd-Commit. An attacker may complete authentication, session key and control of the data connection with a client. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.4 are affected. Both hostapd with EAP-pwd support and wpa_supplicant with EAP-pwd support prior to and including version 2.7 are affected.
Data is provided by the National Vulnerability Database (NVD)
W1.Fi ≫ Wpa Supplicant Version <= 2.4
W1.Fi ≫ Wpa Supplicant Version >= 2.5 <= 2.7
Fedoraproject ≫ Fedora Version28
Fedoraproject ≫ Fedora Version29
Fedoraproject ≫ Fedora Version30
Opensuse ≫ Backports Sle Version15.0 Update-
Opensuse ≫ Backports Sle Version15.0 Updatesp1
Debian ≫ Debian Linux Version8.0
Synology ≫ Radius Server Version3.0
Synology ≫ Router Manager Version1.2
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 1.06% | 0.769 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 8.1 | 2.2 | 5.9 |
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
|
| nvd@nist.gov | 6.8 | 8.6 | 6.4 |
AV:N/AC:M/Au:N/C:P/I:P/A:P
|
CWE-287 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-346 Origin Validation Error
The product does not properly verify that the source of data or communication is valid.