CVE-2019-9495: The implementations of EAP-PWD in hostapd and wpa_supplicant are vulnerable to side-channel attacks as a result of cache access patterns

Severity: low (CVSS 3.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-04-17 · updated 2026-06-17
Weakness: CWE-524

Description

The implementations of EAP-PWD in hostapd and wpa_supplicant are vulnerable to side-channel attacks as a result of cache access patterns. All versions of hostapd and wpa_supplicant with EAP-PWD support are vulnerable. The ability to install and execute applications is necessary for a successful attack. Memory access patterns are visible in a shared cache. Weak passwords may be cracked. Versions of hostapd/wpa_supplicant 2.7 and newer, are not vulnerable to the timing attack described in CVE-2019-9494. Both hostapd with EAP-pwd support and wpa_supplicant with EAP-pwd support prior to and including version 2.7 are affected.

Affected products

Debian Linux: 8.0
Fedoraproject Fedora: 28, 29, 30
FreeBSD: 11.2, 11.2-p2, 11.2-p3, 11.2-p4, 11.2-p5, 11.2-p6 (+8)
openSUSE Backports Sle: 15.0, 15.0-sp1
openSUSE Leap: 15.1
Synology RADIUS Server: 3.0
Synology Router Manager (SRM): before 1.2.3-8017 — fixed in 1.2.3-8017
w1.fi hostapd: through 2.7
Canonical Ltd. wpa_supplicant: through 2.7

How to fix

Upgrade to a fixed version: Synology Router Manager (SRM) 1.2.3-8017. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-9495 or the next vulnerability affects your stack