CVE-2019-9499: The implementations of EAP-PWD in wpa_supplicant EAP Peer do not validate the scalar and element values in EAP-pwd-Commit
Last updated 25 August 2025
Other sources
The implementations of EAP-PWD in wpasupplicant EAP Peer, when built against a crypto library missing explicit validation on imported elements, do not validate the scalar and element values in EAP-pwd-Commit. An attacker may complete authentication, session key and control of the data connection with a client. Both hostapd with SAE support and wpasupplicant with SAE support prior to and including version 2.4 are affected. Both hostapd with EAP-pwd support and wpasupplicant with EAP-pwd support prior to and including version 2.7 are affected.
— Launchpad
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2019-9499?
The severity of CVE-2019-9499 is high.
What is the vulnerability description of CVE-2019-9499?
The implementations of EAP-PWD in wpa_supplicant EAP Peer, when built against a crypto library missing explicit validation on imported elements, do not validate the scalar and element values in EAP-pwd-Commit. An attacker may complete authentication, session key and control of the data connection with a malicious peer.
Which software is affected by CVE-2019-9499?
The software affected by CVE-2019-9499 includes wpa_supplicant versions 2:2.7+git20190128+0c1e29f-6+deb10u3, 2:2.9.0-21, 2:2.10-12, and 2:2.10-15.
How can I fix CVE-2019-9499?
To fix CVE-2019-9499, update wpa_supplicant to version 2.8 or later.
Are there any references for CVE-2019-9499?
Yes, you can find more information about CVE-2019-9499 at the following references: [1](https://seclists.org/bugtraq/2019/May/40) [2](https://w1.fi/security/2019-4/) [3](https://www.synology.com/security/advisory/Synology_SA_19_16)