hostapd/wpa_supplicant up to 2.7 EAP-pwd eap_server_pwd.c denial of service – Digitalmunition

Exploit/Advisories Cybersecurity study of the dark web exposes vulnerability to machine identities -- ScienceDaily

Published on April 29th, 2019 📆 | 1716 Views ⚑


hostapd/wpa_supplicant up to 2.7 EAP-pwd eap_server_pwd.c denial of service

CVSS Meta Temp ScoreCurrent Exploit Price (≈)

A vulnerability was found in hostapd and wpa_supplicant up to 2.7. It has been declared as problematic. Affected by this vulnerability is a code block of the file eap_server/eap_server_pwd.c of the component EAP-pwd. The manipulation with an unknown input leads to a denial of service vulnerability (NULL Pointer Dereference). The CWE definition for the vulnerability is CWE-476. As an impact it is known to affect availability.

The weakness was presented 04/26/2019 (oss-sec). It is possible to read the advisory at This vulnerability is known as CVE-2019-11555 since 04/26/2019. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 2.8 eliminates this vulnerability.


VulDB Meta Base Score: 3.5
VulDB Meta Temp Score: 3.4

VulDB Base Score: ≈3.5
VulDB Temp Score: ≈3.4
VulDB Vector: ?
VulDB Reliability: ?

VulDB Base Score: ?
VulDB Temp Score: ?
VulDB Reliability: ?
Class: Denial of service / NULL Pointer Dereference (CWE-476)
Local: Yes
Remote: No

Availability: ?
Status: Not defined

Price Prediction: ?
Current Price Estimation: ?

Threat Intelligenceinfoedit

Threat: ?
Adversaries: ?
Geopolitics: ?
Economy: ?
Predictions: ?
Remediation: ?Recommended: Upgrade
Status: ?
0-Day Time: ?

Upgrade: hostapd/wpa_supplicant 2.8

04/26/2019 Advisory disclosed
04/26/2019 +0 days CVE assigned
04/27/2019 +1 days VulDB entry created
04/27/2019 +0 days VulDB last updateAdvisory:

CVE: CVE-2019-11555 (?)

Created: 04/27/2019 08:40 AM
Complete: ?

Use the official API to access entries easily!

Tagged with:

Leave a Reply

Your email address will not be published. Required fields are marked *