CVEvulnerability

CVE-2025-24912

3.7 LOW Published 2025-03-12 Modified 2026-06-17 Official page ↗

Status: Analyzed
Published: 2025-03-12
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.0 ([email protected]): 3.7 LOW — CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses: CWE-826

Description

hostapd fails to process crafted RADIUS packets properly. When hostapd authenticates wi-fi devices with RADIUS authentication, an attacker in the position between the hostapd and the RADIUS server may inject crafted RADIUS packets and force RADIUS authentications to fail.

Affected configurations

• w1.fi hostapd (<= 2.11)

Weakness · CWE (1)

CWE-826 Premature Release of Resource During Expected Lifetime weakness

References

https://jvn.jp/en/jp/JVN19358384/ Third Party Advisory
https://w1.fi/cgit/hostap/commit/?id=339a334551ca911187cc870f4f97ef08e11db109 Patch
https://w1.fi/cgit/hostap/commit/?id=726432d7622cc0088ac353d073b59628b590ea44 Patch
https://w1.fi/hostapd/ Product

CVE-2025-24912

Description

Affected configurations

Related

Weakness · CWE (1)

References