CVE-2015-0210
wpa_supplicant 2.0-16 does not properly check certificate subject name, which allows remote...
wpa_supplicant 2.0-16 does not properly check certificate subject name, which allows remote attackers to cause a man-in-the-middle attack.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
wpa_supplicant 2.0-16 does not properly check certificate subject name, which allows remote attackers to cause a man-in-the-middle attack.
- Record
CVE-2015-0210- CVSS 3.0
- 5.9 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
CVE List No score
wpa_supplicant 2.0-16 does not properly check certificate subject name, which allows remote attackers to cause a man-in-the-middle attack.
- Record
CVE-2015-0210- Updated
- 2026-11-02
EUVDEUVD-2015-0247 No score
wpa_supplicant 2.0-16 does not properly check certificate subject name, which allows remote attackers to cause a man-in-the-middle attack.
- Record
EUVD-2015-0247- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4vg4-q9rf-r94r
wpa_supplicant 2.0-16 does not properly check certificate subject name, which allows remote...
wpa_supplicant 2.0-16 does not properly check certificate subject name, which allows remote attackers to cause a man-in-the-middle attack.
- Record
GHSA-4vg4-q9rf-r94r- CVSS 3.0
- 5.9 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
OSVSUSE-SU-2015:1013-1 No score
Security update for wpa_supplicant
wpa_supplicant was updated to fix three security issues:
- CVE-2015-0210: wpa_supplicant: broken certificate subject check this adds the 'domain_match' config option from upstream (additional to the already existing domain_suffix_match)
- CVE-2014-3686: hostapd command execution
- CVE-2015-1863: P2P SSID processing vulnerability
- Record
SUSE-SU-2015:1013-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:1659-1 No score
Security update for wpa_supplicant
This update for wpa_supplicant fixes the following issues:
Security issue fixed:
- CVE-2015-0210: Fix broken certificate subject check (bsc#915323.)
- Record
SUSE-SU-2018:1659-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
wpa_supplicantSUSE:Linux Enterprise Desktop 12 From an advisory covering 3 CVEs |
before 2.2-8.1 | 2.2-8.1 |
wpa_supplicantSUSE:Linux Enterprise Server 12 From an advisory covering 3 CVEs |
before 2.2-8.1 | 2.2-8.1 |
wpa_supplicantSUSE:Linux Enterprise Server for SAP Applications 12 From an advisory covering 3 CVEs |
before 2.2-8.1 | 2.2-8.1 |
wpa_supplicantSUSE:Linux Enterprise Server 11 SP4 |
before 0.7.1-6.18.6.1 | 0.7.1-6.18.6.1 |
wpa_supplicantSUSE:Linux Enterprise Server for SAP Applications 11 SP4 |
before 0.7.1-6.18.6.1 | 0.7.1-6.18.6.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-0210 is a medium vulnerability (CVSS 5.9) in W1.fi Wpa Supplicant, published April 21, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.90%, the 59th percentile. Fixed in wpa_supplicant 0.7.1-6.18.6.1.