CVE-2015-5310 — Sensitive Information Exposure in WPA

CWE-200 — Sensitive Information Exposure10 documents8 sources
Severity
4.3MEDIUMNVD
EPSS
0.3%
top 46.28%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Debian WPAGoogle Android
Timeline
PublishedJan 6
Latest updateMay 14

Description

The WNM Sleep Mode code in wpa_supplicant 2.x before 2.6 does not properly ignore key data in response frames when management frame protection (MFP) was not negotiated, which allows remote attackers to inject arbitrary broadcast or multicast packets or cause a denial of service (ignored packets) via a WNM Sleep Mode response.

CVSS vector

CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages3 packages

▶debiandebian/wpa< wpa 2.3-2.3 (bookworm)
▶NVDgoogle/android5 versions+4

🔴Vulnerability Details

3
GHSA
GHSA-w9vx-28m4-g24h: The WNM Sleep Mode code in wpa_supplicant 2↗2022-05-14
▶
OSV
CVE-2015-5310: The WNM Sleep Mode code in wpa_supplicant 2↗2016-01-06
▶
OSV
wpa vulnerabilities↗2015-11-10
▶

📋Vendor Advisories

4
Android
CVE-2015-5310: Android Security Bulletin 2016-01-01 CVE: CVE-2015-5310 Severity: MEDIUM Affected AOSP versions: 4↗2016-01-01
▶
Red Hat
wpa_supplicant: unauthorized WNM Sleep Mode GTK control↗2015-11-10
▶
Ubuntu
wpa_supplicant and hostapd vulnerabilities↗2015-11-10
▶
Debian
CVE-2015-5310: wpa - The WNM Sleep Mode code in wpa_supplicant 2.x before 2.6 does not properly ignor...↗2015
▶

💬Community

2
Bugzilla
CVE-2015-5310 wpa_supplicant: unauthorized WNM Sleep Mode GTK control [fedora-all]↗2015-11-11
▶
Bugzilla
CVE-2015-5310 wpa_supplicant: unauthorized WNM Sleep Mode GTK control↗2015-11-04
▶