CVE-2025-24912

State: Published
Severity: 3.7 Low
Published: Mar 12, 2025
Updated: Mar 12, 2025
Reserved: Jan 28, 2025

Description

hostapd fails to process crafted RADIUS packets properly. When hostapd authenticates wi-fi devices with RADIUS authentication, an attacker in the position between the hostapd and the RADIUS server may inject crafted RADIUS packets and force RADIUS authentications to fail.

Scores

CVSS	Score	Vector	Source
3.0	3.7 Low	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L	jpcert

Weaknesses

CWE-826 Premature Release of Resource During Expected Lifetime

Affected Products

Product	Versions
hostapdJouni Malinen	2.11 and earlierAffected

References

https://w1.fi/hostapd/
https://w1.fi/cgit/hostap/commit/?id=726432d7622cc0088ac353d073b59628b590ea44
https://w1.fi/cgit/hostap/commit/?id=339a334551ca911187cc870f4f97ef08e11db109
https://jvn.jp/en/jp/JVN19358384/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.