CVE-2025-24912 | THREATINT

Description

hostapd fails to process crafted RADIUS packets properly. When hostapd authenticates wi-fi devices with RADIUS authentication, an attacker in the position between the hostapd and the RADIUS server may inject crafted RADIUS packets and force RADIUS authentications to fail.

Reserved 2025-01-28 | Published 2025-03-12 | Updated 2025-03-12 | Assigner jpcert

LOW: 3.7CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Problem types

Premature Release of Resource During Expected Lifetime

Product status

2.11 and earlier

affected

References

w1.fi/hostapd/

w1.fi/...commit/?id=726432d7622cc0088ac353d073b59628b590ea44

w1.fi/...commit/?id=339a334551ca911187cc870f4f97ef08e11db109

jvn.jp/en/jp/JVN19358384/

cve.org (CVE-2025-24912)

nvd.nist.gov (CVE-2025-24912)

Download JSON