CVE-2019-9494: The implementations of SAE in hostapd and wpa_supplicant are vulnerable to side-channel attacks

Severity: medium (CVSS 5.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-04-17 · updated 2026-06-17
Weakness: CWE-208

Description

The implementations of SAE in hostapd and wpa_supplicant are vulnerable to side channel attacks as a result of observable timing differences and cache access patterns. An attacker may be able to gain leaked information from a side channel attack that can be used for full password recovery. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.7 are affected.

Affected products

Fedoraproject Fedora: 28, 29, 30
FreeBSD: 11.2, 11.2-p2, 11.2-p3, 11.2-p4, 11.2-p5, 11.2-p6 (+8)
openSUSE Backports Sle: 15.0, 15.0-sp1
openSUSE Leap: 15.1
Synology RADIUS Server: 3.0
Synology Router Manager (SRM): before 1.2.3-8087 — fixed in 1.2.3-8087
w1.fi hostapd: through 2.7
Canonical Ltd. wpa_supplicant: through 2.7

How to fix

Upgrade to a fixed version: Synology Router Manager (SRM) 1.2.3-8087. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-9494 or the next vulnerability affects your stack