CVE-2019-9496CWE-642

An invalid authentication sequence could result in the hostapd process terminating due to missing state validation steps

published April 17, 2019

CVSS
—
EPSS
5%
Percentile
91.7
In the wild
Unconfirmed
What it is

An invalid authentication sequence could result in the hostapd process terminating due to missing state validation steps when processing the SAE confirm message when in hostapd/AP mode. All version of hostapd with SAE support are vulnerable. An attacker may force the hostapd process to terminate, performing a denial of service attack. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.7 are affected.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.04669 · 91.7th percentile
Weakness
CWE-642 · External Control of Critical State Data
Published
2019-04-17T13:31Z
EPSS history
Timeline
  • 17 APR 13:31Z
    An invalid authentication sequence could result in the hostapd process terminating due to missing state validation steps
    cvelistv5