CVE-2025-24912

Description

hostapd fails to process crafted RADIUS packets properly. When hostapd authenticates wi-fi devices with RADIUS authentication, an attacker in the position between the hostapd and the RADIUS server may inject crafted RADIUS packets and force RADIUS authentications to fail.

CVSS v3.1 Score

3.7

LOW

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness Type (CWE)

CWE-826 CWE-826

Affected Products

Vendor	Product	Versions
w1.fi	hostapd	< 2.11

References

Advisories & Patches

https://w1.fi/cgit/hostap/commit/?id=339a334551ca911187cc870f4f97ef08e11db109 https://w1.fi/cgit/hostap/commit/?id=726432d7622cc0088ac353d073b59628b590ea44

Other References

https://jvn.jp/en/jp/JVN19358384/ https://w1.fi/hostapd/

Frequently Asked Questions

What is CVE-2025-24912? +

hostapd fails to process crafted RADIUS packets properly. When hostapd authenticates wi-fi devices with RADIUS authentication, an attacker in the position between the hostapd and the RADIUS server may inject crafted RADIUS packets and force RADIUS authentications to fail. It has a CVSS v3.1 base score of 3.7 (LOW).

How severe is CVE-2025-24912? +

CVE-2025-24912 has a CVSS v3.1 score of 3.7 out of 10, rated LOW. This is a low-severity vulnerability with limited impact.

What products are affected by CVE-2025-24912? +

CVE-2025-24912 affects products from w1.fi, specifically: hostapd. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-24912? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-31115

XZ Utils provide a general-purpose data-compression library plus command-line tools. In XZ Utils 5.3.3alpha to 5.8.0, the multithreaded .xz decoder …

CVE-2026-53322 8.8

In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Clean up DMABUFs before disabling function On device shutdown, …

CVE-2024-51727 6.5

Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x contains a feature that could enable attackers to invalidate …

CVE-2024-58249 3.7

In wxWidgets before 3.2.7, a crash can be triggered in wxWidgets apps when connections are refused in wxWebRequestCURL.

CVE-2024-5290 8.8

An issue was discovered in Ubuntu wpa_supplicant that resulted in loading of arbitrary shared objects, which allows a local unprivileged …

CVE-2026-58374 6.5

In hostapd before 2.12, a missing bounds check in AP-mode Wi-Fi 7 (IEEE 802.11be) Multi-Link Operation (MLO) association request processing …