« Volver al listado

CVE-2025-24912

Estado: AnalizadaBaja (3.7)—

hostapd fails to process crafted RADIUS packets properly. When hostapd authenticates wi-fi devices with RADIUS authentication, an attacker in the position between the hostapd and the RADIUS server may inject crafted RADIUS packets and force RADIUS authentications to fail.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

W1.fi — Hostapd

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-24912",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-24912",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-03-12T13:21:52.296145Z"
        }
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "vultures@jpcert.or.jp",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 3.7,
          "attackVector": "NETWORK",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "vultures@jpcert.or.jp",
      "affectedData": [
        {
          "vendor": "Jouni Malinen",
          "product": "hostapd",
          "versions": [
            {
              "status": "affected",
              "version": "2.11 and earlier"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-03-12T05:15:37.430",
  "references": [
    {
      "url": "https://jvn.jp/en/jp/JVN19358384/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://w1.fi/cgit/hostap/commit/?id=339a334551ca911187cc870f4f97ef08e11db109",
      "tags": [
        "Patch"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://w1.fi/cgit/hostap/commit/?id=726432d7622cc0088ac353d073b59628b590ea44",
      "tags": [
        "Patch"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://w1.fi/hostapd/",
      "tags": [
        "Product"
      ],
      "source": "vultures@jpcert.or.jp"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "vultures@jpcert.or.jp",
      "description": [
        {
          "lang": "en",
          "value": "CWE-826"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "hostapd fails to process crafted RADIUS packets properly. When hostapd authenticates wi-fi devices with RADIUS authentication, an attacker in the position between the hostapd and the RADIUS server may inject crafted RADIUS packets and force RADIUS authentications to fail."
    },
    {
      "lang": "es",
      "value": "hostapd no procesa correctamente los paquetes RADIUS manipulados. Cuando hostapd autentica dispositivos Wi-Fi con autenticación RADIUS, un atacante ubicado entre hostapd y el servidor RADIUS podría inyectar paquetes RADIUS manipulados y forzar el fallo de las autenticaciones RADIUS."
    }
  ],
  "lastModified": "2026-06-17T08:59:50.027",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:w1.fi:hostapd:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2634D924-B17C-47D4-B6DE-F69736D79E54",
              "versionEndIncluding": "2.11"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "vultures@jpcert.or.jp"
}