CVE-2019-9495: The implementations of EAP-PWD in hostapd and wpa_supplicant are vulnerable to side-channel attacks as a result of cache access patterns
Vulnerability summary
CVE-2019-9495 is a medium (CVSS 4.3) vulnerability in debian debian_linux. EPSS estimates a 3.48% chance of exploitation in the next 30 days, higher than 89.1% of scored vulnerabilities.
Not severe (CVSS 3.7, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 11 · Related 9Timeline
- 17-04-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
The implementations of EAP-PWD in hostapd and wpa_supplicant are vulnerable to side-channel attacks as a result of cache access patterns. All versions of hostapd and wpa_supplicant with EAP-PWD support are vulnerable. The ability to install and execute applications is necessary for a successful attack. Memory access patterns are visible in a shared cache. Weak passwords may be cracked. Versions of hostapd/wpa_supplicant 2.7 and newer, are not vulnerable to the timing attack described in CVE-2019-9494. Both hostapd with EAP-pwd support and wpa_supplicant with EAP-pwd support prior to and including version 2.7 are affected.
CVSS metrics
6 scores · 4 sources · 3 versions- OSV · UbuntuEcosystem advisory · calculated3.7LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- OSV · DebianEcosystem advisory · calculated3.7LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- NVDNIST3.7LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS trend
Probability
3.48%
Chance of exploitation in the next 30 days
Percentile
89%
Versus all other CVEs
30-day change
No change 0.00 pp
From 3.48% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-524Use of Cache Containing Sensitive InformationThe code uses a cache that contains sensitive information, but the cache can be read by an actor outside of the intended control sphere.
- CWE-203Observable DiscrepancyThe product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Debian2 products
- wpa< 2:2.7+git20190128+0c1e29f-4
- debian_linuxEOL8.0
Opensuse2 products
- backports_sle15.0 | 15.0:sp1
- leapEOL15.1
Synology2 products
- radius_server3.0
- router_manager< 1.2.3-8017
W1.fi2 products
- hostapd≤ 2.7
- wpa_supplicant≤ 2.7
Wi-fi alliance2 products
Alpine1 product
- wpa_supplicant< 2.7-r2
Fedoraproject1 product
- fedoraEOL28 | 29 | 30
Freebsd1 product
- freebsdEOL11.2 | 11.2:p2 | 11.2:p3 | 11.2:p4 | 11.2:p5 | 11.2:p6 | 11.2:p7 | 11.2:p8 | 11.2:p9 | 11.2:rc3 | 12.0 | 12.0:p1 | 12.0:p2 | 12.0:p3
Ubuntu1 product
- wpa< 2.1-0ubuntu1.7 | < 2.4-0ubuntu6.4 | < 2:2.6-15ubuntu2.2
9 vendors · 14 products
References
15 links- security.freebsd.org/advisories/FreeBSD-SA-19:03.wpa.ascVendor AdvisoryX Refsource FREEBSDThird Party Advisory
- packetstormsecurity.com/files/152914/FreeBSD-Security-Advisory-FreeBSD-SA-19-03.wpa.htmlX Refsource MISCThird Party AdvisoryVDB Entry
lists.debian.org/debian-lts-announce/2019/07/msg00030.htmlMailing ListX Refsource MLISTThird Party Advisory- lists.opensuse.org/opensuse-security-announce/2020-02/msg00021.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory