« Volver al listado

CVE-2026-25532

Estado: AnalizadaAlta (8)—

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.2, 5.4.3, 5.3.4, 5.2.6, and 5.1.6, a vulnerability exists in the WPS (Wi-Fi Protected Setup) Enrollee implementation where malformed EAP-WSC packets with truncated payloads can cause integer underflow during fragment length calculation. When processing EAP-Expanded (WSC) messages, the code computes frag_len by subtracting header sizes from the total packet length.

Leer descripción completaMostrar menos

If an attacker sends a packet where the EAP Length field covers only the header and flags but omits the expected payload (such as the 2-byte Message Length field when WPS_MSG_FLAG_LEN is set), frag_len becomes negative. This negative value is then implicitly cast to size_t when passed to wpabuf_put_data(), resulting in a very large unsigned value. This issue has been patched in versions 5.5.3, 5.4.4, 5.3.5, 5.2.7, and 5.1.7.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vector AV:A (red adyacente) con UI:R (interacción del usuario) → T1203. Malformed packets causan integer underflow → ejecución de código (T1059) o crash/DoS (T1499.004) en dispositivo IoT.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Restrict Web-Based ContentPrivileged Account ManagementLimit Software InstallationFilter Network TrafficExecution PreventionBehavior Prevention on Endpoint

Tecnologías afectadas (1)

Espressif — Esp-idf

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-25532",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-25532",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-02-04T19:24:33.788979Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.3,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 4.2,
        "exploitabilityScore": 2.1
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.1
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "espressif",
          "product": "esp-idf",
          "versions": [
            {
              "status": "affected",
              "version": "= 5.5.2"
            },
            {
              "status": "affected",
              "version": "= 5.4.3"
            },
            {
              "status": "affected",
              "version": "= 5.3.4"
            },
            {
              "status": "affected",
              "version": "= 5.2.6"
            },
            {
              "status": "affected",
              "version": "= 5.1.6"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-02-04T18:16:09.747",
  "references": [
    {
      "url": "https://github.com/espressif/esp-idf/commit/60f992a26de17bb5406f2149a2f8282dd7ad1c59",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/espressif/esp-idf/commit/6f6766f917bc940ffbcc97eac4765a6ab15d5f79",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/espressif/esp-idf/commit/73a587d42a57ece1962b6a4c530b574600650f63",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/espressif/esp-idf/commit/b209fae993d795255827ce6b2b0d6942a377f5d4",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/espressif/esp-idf/commit/b88befde6b5addcdd8d7373ce55c8052dea1e855",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/espressif/esp-idf/commit/cad36beb4cde27abcf316cd90d8d8dddbc6f213a",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/espressif/esp-idf/commit/de28801e8ea6a736b6f0db6fc0c682739363bb41",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/espressif/esp-idf/security/advisories/GHSA-m2h2-683f-9mw7",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-191"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.2, 5.4.3, 5.3.4, 5.2.6, and 5.1.6, a vulnerability exists in the WPS (Wi-Fi Protected Setup) Enrollee implementation where malformed EAP-WSC packets with truncated payloads can cause integer underflow during fragment length calculation. When processing EAP-Expanded (WSC) messages, the code computes frag_len by subtracting header sizes from the total packet length. If an attacker sends a packet where the EAP Length field covers only the header and flags but omits the expected payload (such as the 2-byte Message Length field when WPS_MSG_FLAG_LEN is set), frag_len becomes negative. This negative value is then implicitly cast to size_t when passed to wpabuf_put_data(), resulting in a very large unsigned value. This issue has been patched in versions 5.5.3, 5.4.4, 5.3.5, 5.2.7, and 5.1.7."
    },
    {
      "lang": "es",
      "value": "ESF-IDF es el Framework de Desarrollo de Internet de las Cosas (IoT) de Espressif. En las versiones 5.5.2, 5.4.3, 5.3.4, 5.2.6 y 5.1.6, existe una vulnerabilidad en la implementación de Enrollee de WPS (Wi-Fi Protected Setup) donde paquetes EAP-WSC malformados con cargas útiles truncadas pueden causar un desbordamiento negativo de enteros (integer underflow) durante el cálculo de la longitud del fragmento. Al procesar mensajes EAP-Expanded (WSC), el código calcula frag_len restando los tamaños de las cabeceras de la longitud total del paquete. Si un atacante envía un paquete donde el campo EAP Length cubre solo la cabecera y las banderas (flags) pero omite la carga útil esperada (como el campo Message Length de 2 bytes cuando WPS_MSG_FLAG_LEN está configurado), frag_len se vuelve negativo. Este valor negativo se convierte implícitamente a size_t cuando se pasa a wpabuf_put_data(), lo que resulta en un valor sin signo muy grande. Este problema ha sido parcheado en las versiones 5.5.3, 5.4.4, 5.3.5, 5.2.7 y 5.1.7."
    }
  ],
  "lastModified": "2026-06-17T10:24:48.313",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:espressif:esp-idf:5.1.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "90D991F0-A03E-44CF-9187-75897399797A"
            },
            {
              "criteria": "cpe:2.3:a:espressif:esp-idf:5.2.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "37A040C2-E9D4-4678-9A10-74B5AEE4901D"
            },
            {
              "criteria": "cpe:2.3:a:espressif:esp-idf:5.3.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AA4D9168-C8C1-4B1A-81C3-D4888DB36CAE"
            },
            {
              "criteria": "cpe:2.3:a:espressif:esp-idf:5.4.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7CA4F443-03D3-4B10-909E-A813F72BC08C"
            },
            {
              "criteria": "cpe:2.3:a:espressif:esp-idf:5.5.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "43489143-3F90-42E6-B75F-78CBEAD09C4D"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}