Description
In hostapd 2.10 and earlier, the PKEX code remains active even after a successful PKEX association. An attacker that successfully bootstrapped public keys with another entity using PKEX in the past, will be able to subvert a future bootstrapping by passively observing public keys, re-using the encrypting element Qi and subtracting it from the captured message M (X = M - Qi). This will result in the public ephemeral key X; the only element required to subvert the PKEX association.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | wpa | 2:2.10-24 | — |
| Debian 13 | wpa | 2:2.10-24 | — |
| Debian 12 | wpa | 2:2.10-12+deb12u3 | — |
| Debian 11 | wpa | 2:2.9.0-21+deb11u3 | DLA-4123-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | wpa | 2:2.10-21ubuntu0.2 | USN-7317-1 |
| Ubuntu 22.04 LTS | wpa | 2:2.10-6ubuntu2.2 | USN-7317-1 |
| Ubuntu 20.04 LTS | wpa | 2:2.9-1ubuntu4.6 | USN-7317-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | hostapd | 2.12-1.1 | openSUSE-SU-2026:12398-1 |
Advisories 7
- openSUSE-SU-2026:12398-1 hostapd-2.12-1.1 on GA media SUSE / openSUSE Security Updates · Nov 4, 2026
- ICSA-26-202-04 Siemens SIDIS Secured SmartPlug CISA ICS & IT advisories · Jul 21, 2026
- NCSC-2026-0229 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Jul 14, 2026
- SSA-585531 SSA-585531: Multiple Vulnerabilities in SIDIS Secured SmartPlug before V7.26.0310 Siemens ProductCERT · Jul 14, 2026
- USN-7317-1 wpa vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- DLA-4123-1 wpa - security update Debian Security (DSA / DLA) · Mar 9, 2026
- WID-SEC-2025-0355 hostapd: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Apr 13, 2025