CVE-2019-9495: The implementations of EAP-PWD in hostapd and wpa_supplicant are vulnerable to side-channel attacks as a result of cache access patterns
Last updated 25 August 2025
Other sources
The implementations of EAP-PWD in hostapd and wpasupplicant are vulnerable to side-channel attacks as a result of cache access patterns. All versions of hostapd and wpasupplicant with EAP-PWD support are vulnerable. The ability to install and execute applications is necessary for a successful attack. Memory access patterns are visible in a shared cache. Weak passwords may be cracked. Versions of hostapd/wpasupplicant 2.7 and newer, are not vulnerable to the timing attack described in CVE-2019-9494. Both hostapd with EAP-pwd support and wpasupplicant with EAP-pwd support prior to and including version 2.7 are affected.
— Launchpad
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2019-9495.
What is the severity of CVE-2019-9495?
The severity of CVE-2019-9495 is medium with a CVSS score of 3.7.
Which software versions are affected by CVE-2019-9495?
All versions of hostapd and wpa_supplicant with EAP-PWD support are affected by CVE-2019-9495.
How can I fix CVE-2019-9495?
To fix CVE-2019-9495, update hostapd and wpa_supplicant to version 2.8 or later.
Where can I find more information about CVE-2019-9495?
You can find more information about CVE-2019-9495 in the following references: [Reference 1](http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00021.html), [Reference 2](http://packetstormsecurity.com/files/152914/FreeBSD-Security-Advisory-FreeBSD-SA-19-03.wpa.html), [Reference 3](https://lists.debian.org/debian-lts-announce/2019/07/msg00030.html)