CVE-2019-9499

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

The implementations of EAP-PWD in wpa_supplicant EAP Peer, when built against a crypto library missing explicit validation on imported elements, do not validate the scalar and element values in EAP-pwd-Commit. An attacker may complete authentication, session key and control of the data connection with a client. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.4 are affected. Both hostapd with EAP-pwd support and wpa_supplicant with EAP-pwd support prior to and including version 2.7 are affected.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-346CWE-287

Affected software

VendorProductVersions
Wi-Fi Alliancehostapd with EAP-pwd support>= 2.7, <= 2.7
Wi-Fi Alliancewpa_supplicant with EAP-pwd support>= 2.7, <= 2.7
Wi-Fi Alliancehostapd with SAE support>= 2.4, <= 2.4
Wi-Fi Alliancewpa_supplicant with SAE support>= 2.4, <= 2.4

References

Timeline

Published
Apr 17, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-95008.3The Broadcom brcmfmac WiFi driver prior to commit 1b5e2423164b3670e8bc9174e4762d297990deff is vulnerable to a heap buffer overflow. If the WCVE-2019-95018.8The Broadcom wl WiFi driver is vulnerable to a heap buffer overflow. By supplying a vendor information element with a data length larger thaCVE-2019-95028.8The Broadcom wl WiFi driver is vulnerable to a heap buffer overflow. If the vendor information element data length is larger than 164 bytes,CVE-2019-95038.3The Broadcom brcmfmac WiFi driver prior to commit a4176ec356c73a46c07c181c6d04039fafa34a9f is vulnerable to a frame validation bypass. If thCVE-2019-95059.8The PrinterLogic Print Management software, versions up to and including 18.3.1.96, does not sanitize special characters allowing for remoteCVE-2019-95068.1The Bluetooth BR/EDR specification up to and including version 5.1 permits sufficiently low encryption key length and does not prevent an atCVE-2019-95077.2The web interface of the Vertiv Avocent UMG-4000 version 4.2.1.19 is vulnerable to command injection because the application incorrectly neuCVE-2019-95083.5The web interface of the Vertiv Avocent UMG-4000 version 4.2.1.19 is vulnerable to stored XSS. A remote attacker authenticated with an adminCVE-2019-95095.4The web interface of the Vertiv Avocent UMG-4000 version 4.2.1.19 is vulnerable to reflected XSS in an HTTP POST parameter. The web applicatCVE-2019-95107.8A vulnerability in Microsoft Windows 10 1803 and Windows Server 2019 and later systems can allow authenticated RDP-connected clients to gainCVE-2019-95117.5Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a deniCVE-2019-95127.5Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to
CVE-2019-9499: High severity, CVSS 8.1 | Vulnix