CVE-2025-24912

3.7 lowEPSS 0.8%

Low (3.7) in w1.fi hostapd. EPSS 0.8% chance of exploitation in the next 30 days.

hostapd fails to process crafted RADIUS packets properly. When hostapd authenticates wi-fi devices with RADIUS authentication, an attacker in the position between the hostapd and the RADIUS server may inject crafted RADIUS packets and force RADIUS authentications to fail.

Severity

CVSS 3.0

3.7 low

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS: 0.8% chance of exploitation in the next 30 days; higher than 55% of CVEs (scores of 2026-10-31)
CWE: CWE-826
Published: 2025-03-12
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

w1.fi:hostapd

References

https://jvn.jp/en/jp/JVN19358384/
https://w1.fi/cgit/hostap/commit/?id=339a334551ca911187cc870f4f97ef08e11db109
https://w1.fi/cgit/hostap/commit/?id=726432d7622cc0088ac353d073b59628b590ea44
https://w1.fi/hostapd/

Check your stack JSON