CVE-2009-2822

Status: ModifiedMedium (6.8)—

AirPort Utility before 5.5.1 for Apple AirPort Base Station does not properly distribute MAC address ACLs to network extenders, which allows remote attackers to bypass intended access restrictions via an 802.11 authentication frame.

CVSS

Version: 2.0
Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Base score: 6.8

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 1.54%
Percentile among all scored CVEs: 74
Score date: 10/9/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Apple — Airport Utility

CWEs

CWE-264

References

Raw JSON (NVD)

Show

{
  "id": "CVE-2009-2822",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2010-04-05T16:30:00.407",
  "references": [
    {
      "url": "http://lists.apple.com/archives/security-announce/2010//Mar/msg00004.html",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/39160",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://securitytracker.com/id?1023801",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://support.apple.com/kb/HT3958",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.osvdb.org/63420",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/39134",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2010/0778",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/57434",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://lists.apple.com/archives/security-announce/2010//Mar/msg00004.html",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/39160",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://securitytracker.com/id?1023801",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://support.apple.com/kb/HT3958",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.osvdb.org/63420",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/39134",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2010/0778",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/57434",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "AirPort Utility before 5.5.1 for Apple AirPort Base Station does not properly distribute MAC address ACLs to network extenders, which allows remote attackers to bypass intended access restrictions via an 802.11 authentication frame."
    },
    {
      "lang": "es",
      "value": "AirPort Utility anteriores a v5.5.1 para Apple AirPort Base Station no reparte listas de control de acceso (ACL) de direcciones MAC a los extendedores de redes, lo que permite a atacantes remotos saltarse la citadas restricciones de acceso a través de un marco de autenticación 802.11."
    }
  ],
  "lastModified": "2026-06-16T23:10:17.590",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apple:airport_utility:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C2F999B5-C91C-43D2-8531-7CBB0DF86ECD",
              "versionEndIncluding": "5.4.2"
            },
            {
              "criteria": "cpe:2.3:a:apple:airport_utility:5.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F1BA856F-6D42-42AC-B975-2A7927536E50"
            },
            {
              "criteria": "cpe:2.3:a:apple:airport_utility:5.3.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6AB57FF2-5355-4206-AF27-846B3D5E2630"
            },
            {
              "criteria": "cpe:2.3:a:apple:airport_utility:5.3.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4D4F51A7-50DC-4392-9729-359AE02BEF66"
            },
            {
              "criteria": "cpe:2.3:a:apple:airport_utility:5.4.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "28375618-90B2-4A94-BDFC-D960A3237F88"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:apple:airport_base_station:*:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "6E207B64-7129-48BD-9EAE-7773ECDDBBC0"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}