Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2019-9496— An invalid authentication sequence could result in the hostapd process terminating due to missing state validation steps

Quick assessment

Affected
Wi-Fi Alliance hostapd with SAE support
Exploitation
High exploitation probability; assess promptly
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

hostapd是一款访问点和身份验证服务器的用户空间守护程序。 hostapd中存在安全漏洞。攻击者可利用该漏洞造成拒绝服务。

AI Predicted 6.5 Difficulty: Easy EPSS 4.67% · P91
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2019-9496

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
An invalid authentication sequence could result in the hostapd process terminating due to missing state validation steps
Source: CVE Program / CVE List V5
Vulnerability Description
An invalid authentication sequence could result in the hostapd process terminating due to missing state validation steps when processing the SAE confirm message when in hostapd/AP mode. All version of hostapd with SAE support are vulnerable. An attacker may force the hostapd process to terminate, performing a denial of service attack. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.7 are affected.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
对关键状态数据的外部可控制
Source: CVE Program / CVE List V5
Vulnerability Title
hostapd 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
hostapd是一款访问点和身份验证服务器的用户空间守护程序。 hostapd中存在安全漏洞。攻击者可利用该漏洞造成拒绝服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Wi-Fi Alliance hostapd with SAE support 2.7 ~ 2.7 -
Wi-Fi Alliance wpa_supplicant with SAE support 2.7 ~ 2.7 -

II. Public POCs for CVE-2019-9496

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2019-9496

请登录查看更多情报信息。

Exploits & Public PoCs for CVE-2019-9496 (1)

Mailing List Discussions for CVE-2019-9496 (3)

Other References for CVE-2019-9496 (3)

Same Patch Batch · Wi-Fi Alliance · 2019-04-17 · 6 CVEs total

CVE-2019-9494 The implementations of SAE in hostapd and wpa_supplicant are vulnerable to side-channel at
CVE-2019-9495 The implementations of EAP-PWD in hostapd and wpa_supplicant are vulnerable to side-channe
CVE-2019-9497 The implementations of EAP-PWD in hostapd EAP Server and wpa_supplicant EAP Peer do not va
CVE-2019-9498 The implementations of EAP-PWD in hostapd EAP Server do not validate the scalar and elemen
CVE-2019-9499 The implementations of EAP-PWD in wpa_supplicant EAP Peer do not validate the scalar and e

IV. Related Vulnerabilities

Same product: hostapd with SAE support
Same vendor: Wi-Fi Alliance
Same weakness: CWE-642

V. Comments for CVE-2019-9496

No comments yet

Leave a comment