CVEvulnerability

CVE-2019-5061

6.5 MEDIUM Published 2019-12-12 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-12-12
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.0 ([email protected])
7.4 HIGH — CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
CVSS 2.0 ([email protected])
3.3 LOW — AV:A/AC:L/Au:N/C:N/I:N/A:P
Weaknesses
CWE-287, CWE-440

Description

An exploitable denial-of-service vulnerability exists in the hostapd 2.6, where an attacker could trigger AP to send IAPP location updates for stations, before the required authentication process has completed. This could lead to different denial of service scenarios, either by causing CAM table attacks, or by leading to traffic flapping if faking already existing clients in other nearby Aps of the same wireless infrastructure. An attacker can forge Authentication and Association Request packets to trigger this vulnerability.

Affected configurations

• w1.fi hostapd 2.6

Related

Weakness · CWE (2)

  • CWE-287 Improper Authentication weakness
  • CWE-440 Expected Behavior Violation weakness

References