Skip to content
Fencer Intel
high 8.1

CVE-2019-9497 json

The implementations of EAP-PWD in hostapd EAP Server and wpa_supplicant EAP Peer do not validate the scalar and element values in EAP-pwd-Commit

published 7y ago modified 4mo ago also EUVD-2019-18871

cvss
8.1
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
5.0%
EPSS 5.0% chance of exploitation in 30 days, percentile 92%
public exploits
0
none known

Summary

The implementations of EAP-PWD in hostapd EAP Server and wpa_supplicant EAP Peer do not validate the scalar and element values in EAP-pwd-Commit. This vulnerability may allow an attacker to complete EAP-PWD authentication without knowing the password. However, unless the crypto library does not implement additional checks for the EC point, the attacker will not be able to derive the session key or complete the key exchange. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.4 are affected. Both hostapd with EAP-pwd support and wpa_supplicant with EAP-pwd support prior to and including version 2.7 are affected.

Patch / fix

  • wpa Debian 14, Debian 13, Debian 12 2:2.7+git20190128+0c1e29f-4

debian advisories DEBIAN-CVE-2019-9497

  • wpa Ubuntu 14.04 LTS 2.1-0ubuntu1.7
  • wpa Ubuntu 16.04 LTS 2.4-0ubuntu6.4
  • wpa Ubuntu 18.04 LTS 2:2.6-15ubuntu2.2

ubuntu advisories UBUNTU-CVE-2019-9497

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • wpa_supplicant SLES for SAP 12 SP4, SLES for SAP 12 SP3, SLES 12 SP4-LTSS +8 more 2.9-15.22.1
  • wpa_supplicant SLES for SAP 12 SP5, SLES 12 SP5 2.9-23.3.1
  • wpa_supplicant SLES for SAP 15, SLES 15-LTSS, SLE Module for Basesystem 15 SP2 +3 more 2.9-4.20.1

suse advisories SUSE-SU-2022:1853-1SUSE-SU-2020:3424-1SUSE-SU-2020:3380-1

  • hostapd openSUSE Tumbleweed 2.9-6.2
  • wpa_supplicant openSUSE Tumbleweed 2.9-13.4
  • wpa_supplicant openSUSE Leap 15.2 2.9-lp152.8.3.1
  • wpa_supplicant openSUSE Leap 15.1 2.9-lp151.5.10.1
  • hostapd Package Hub 15 SP1, Package Hub 15, openSUSE Leap 15.1 2.9-bp151.5.3.1

opensuse advisories openSUSE-SU-2024:10846-1openSUSE-SU-2024:11515-1openSUSE-SU-2020:2059-1openSUSE-SU-2020:2053-1openSUSE-SU-2020:0222-1

  • wpa_supplicant Alpine 3.24, Alpine 3.23, Alpine 3.22 +13 more 2.7-r2

alpine advisories ALPINE-CVE-2019-9497

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Is CVE-2019-9497 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-9497 updated cvss 4.3

wpa_supplicant: EAP-pwd server not checking for reflection attack

  • Red Hat Enterprise Linux 5 wpa_supplicant Red Hat Enterprise Linux 6 wpa_supplicant Red Hat Enterprise Linux 7 wpa_supplicant Red Hat Enterprise Linux 8 wpa_supplicant Red Hat Virtualization 4 rhvm-appliance, redhat-virtualization-host-image-update
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

4.99% chance of exploitation in the next 30 days, higher than 92% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.0 8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected products

  • Wi-Fi Alliance hostapd with EAP-pwd support
  • Wi-Fi Alliance wpa_supplicant with EAP-pwd support
  • Wi-Fi Alliance hostapd with SAE support
  • Wi-Fi Alliance wpa_supplicant with SAE support

Classification

Weakness
  • CWE-301 Reflection Attack in an Authentication Protocol
  • CWE-287 Improper Authentication

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.