What’s Vulnerable › Vulnerabilities

CVE-2025-24912

• Severity: low (CVSS 3.7 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-03-12 · updated 2026-06-17
• Weakness: CWE-826

Description

hostapd fails to process crafted RADIUS packets properly. When hostapd authenticates wi-fi devices with RADIUS authentication, an attacker in the position between the hostapd and the RADIUS server may inject crafted RADIUS packets and force RADIUS authentications to fail.

Affected products

• w1.fi hostapd: through 2.11

References

• https://jvn.jp/en/jp/JVN19358384/
• https://w1.fi/cgit/hostap/commit/?id=339a334551ca911187cc870f4f97ef08e11db109
• https://w1.fi/cgit/hostap/commit/?id=726432d7622cc0088ac353d073b59628b590ea44
• https://w1.fi/hostapd/

Get alerted when CVE-2025-24912 or the next vulnerability affects your stack