CVE-2019-9499: The implementations of EAP-PWD in wpa_supplicant EAP Peer do not validate the scalar and element values in EAP-pwd-Commit
Vulnerability summary
CVE-2019-9499 is a high (CVSS 8.1) Origin Validation Error vulnerability in debian debian_linux. EPSS estimates a 2.21% chance of exploitation in the next 30 days, higher than 82.6% of scored vulnerabilities.
Severe, CVSS 8.1 (NVD); no exploitation reported by the 5 checked sources; EPSS 2% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 11 · Related 9Timeline
- 17-04-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
The implementations of EAP-PWD in wpa_supplicant EAP Peer, when built against a crypto library missing explicit validation on imported elements, do not validate the scalar and element values in EAP-pwd-Commit. An attacker may complete authentication, session key and control of the data connection with a client. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.4 are affected. Both hostapd with EAP-pwd support and wpa_supplicant with EAP-pwd support prior to and including version 2.7 are affected.
CVSS metrics
6 scores · 4 sources · 3 versions- OSV · AlpineEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
2.21%
Chance of exploitation in the next 30 days
Percentile
83%
Versus all other CVEs
30-day change
No change 0.00 pp
From 2.21% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Wi-fi alliance4 products
Debian2 products
- wpa< 2:2.7+git20190128+0c1e29f-4
- debian_linuxEOL8.0
Opensuse2 products
- backports_sle15.0 | 15.0:sp1
- leapEOL15.1
Synology2 products
W1.fi2 products
- hostapd≤ 2.4 | ≥ 2.5, ≤ 2.7
- wpa_supplicant≤ 2.4 | ≥ 2.5, ≤ 2.7
Alpine1 product
- wpa_supplicant≥ 2.5, < 2.7-r2
Fedoraproject1 product
- fedoraEOL28 | 29 | 30
Freebsd1 product
- freebsdEOL≥ 11.0, ≤ 11.1 | 11.2 | 11.2:p13 | 11.2:p2 | 11.2:p3 | 11.2:p4 | 11.2:p5 | 11.2:p6 | 11.2:p7 | 11.2:p8 | 11.2:p9 | 12.0 | 12.0:p1 | 12.0:p2 | 12.0:p3
Ubuntu1 product
- wpa< 2.1-0ubuntu1.7 | < 2.4-0ubuntu6.4 | < 2:2.6-15ubuntu2.2
9 vendors · 16 products
References
14 links- security.freebsd.org/advisories/FreeBSD-SA-19:03.wpa.ascVendor AdvisoryX Refsource FREEBSDThird Party Advisory
lists.debian.org/debian-lts-announce/2019/07/msg00030.htmlMailing ListX Refsource MLISTThird Party Advisory- lists.opensuse.org/opensuse-security-announce/2020-02/msg00021.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory