CVE-2014-3686 — Improper Input Validation in Hostapd

CWE-20 — Improper Input ValidationCWE-78 — OS Command Injection12 documents8 sources
Severity
6.8MEDIUMNVD
EPSS
4.7%
top 10.66%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Canonical Ubuntu LinuxDebian LinuxW1.fi Hostapd+1 more
Timeline
PublishedOct 16
Latest updateMay 17

Description

wpa_supplicant and hostapd 0.7.2 through 2.2, when running with certain configurations and using wpa_cli or hostapd_cli with action scripts, allows remote attackers to execute arbitrary commands via a crafted frame.

CVSS vector

AV:N/AC:M/C:P/I:P/A:PExploitability: 8.6 | Impact: 6.4

Affected Packages2 packages

▶NVDw1.fi/hostapd6 versions+5
▶NVDw1.fi/wpa_supplicant6 versions+5

Also affects: Debian Linux 6.0, Ubuntu Linux 10.04, 12.04, 14.04

🔴Vulnerability Details

3
GHSA
GHSA-mvf7-8vcg-m9vv: wpa_supplicant and hostapd 0↗2022-05-17
▶
CVEList
CVE-2014-3686: wpa_supplicant and hostapd 0↗2014-10-16
▶
OSV
CVE-2014-3686: wpa_supplicant and hostapd 0↗2014-10-16
▶

📋Vendor Advisories

3
Ubuntu
wpa_supplicant vulnerability↗2014-10-14
▶
Red Hat
hostapd: wpa_cli and hostapd_cli remote command execution issue↗2014-10-10
▶
Debian
CVE-2014-3686: wpa - wpa_supplicant and hostapd 0.7.2 through 2.2, when running with certain configur...↗2014
▶

💬Community

5
Bugzilla
CVE-2014-3686 hostapd: wpa_cli and hostapd_cli remote command execution issue [fedora-all]↗2014-10-10
▶
Bugzilla
CVE-2014-3686 hostapd: wpa_cli and hostapd_cli remote command execution issue [epel-7]↗2014-10-10
▶
Bugzilla
CVE-2014-3686 wpa_supplicant and hostapd: wpa_cli and hostapd_cli remote command execution issue↗2014-10-10
▶
Bugzilla
CVE-2014-3686 wpa_supplicant: wpa_supplicant and hostapd: wpa_cli and hostapd_cli remote command execution issue [fedora-all]↗2014-10-10
▶
Bugzilla
CVE-2014-3686 hostapd: wpa_cli and hostapd_cli remote command execution issue [epel-6]↗2014-10-10
▶
CVE-2014-3686 — Improper Input Validation in Hostapd | cvebase