CVE-2024-5290
An issue was discovered in Ubuntu wpa_supplicant that resulted in loading of arbitrary shared...
An issue was discovered in Ubuntu wpa_supplicant that resulted in loading of arbitrary shared objects, which allows a local unprivileged attacker to escalate privileges to the user that wpa_supplicant runs as (usually root).
Membership in the netdev group or access to the dbus interface of wpa_supplicant allow an unprivileged user to specify an arbitrary path to a module to be loaded by the wpa_supplicant process; other escalation paths might exist.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
An issue was discovered in Ubuntu wpa_supplicant that resulted in loading of arbitrary shared objects, which allows a local unprivileged attacker to escalate privileges to the user that wpa_supplicant runs as (usually root).
Membership in the netdev group or access to the dbus interface of wpa_supplicant allow an unprivileged user to specify an arbitrary path to a module to be loaded by the wpa_supplicant process; other escalation paths might exist.
- Record
CVE-2024-5290- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-427
- Updated
- 2026-11-02
EUVDEUVD-2024-46526
An issue was discovered in Ubuntu wpa_supplicant that resulted in loading of arbitrary shared objects, which allows a local unprivileged attacker to escalate privileges to the user that wpa_supplicant runs as (usually root).
Membership in the netdev group or access to the dbus interface of wpa_supplicant allow an unprivileged user to specify an arbitrary path to a module to be loaded by the wpa_supplicant process; other escalation paths might exist.
- Record
EUVD-2024-46526- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-c2m5-cmpw-rjcx
An issue was discovered in Ubuntu wpa_supplicant that resulted in loading of arbitrary shared...
An issue was discovered in Ubuntu wpa_supplicant that resulted in loading of arbitrary shared objects, which allows a local unprivileged attacker to escalate privileges to the user that wpa_supplicant runs as (usually root).
Membership in the netdev group or access to the dbus interface of wpa_supplicant allow an unprivileged user to specify an arbitrary path to a module to be loaded by the wpa_supplicant process; other escalation paths might exist.
- Record
GHSA-c2m5-cmpw-rjcx- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-427
- Updated
- 2026-11-02
NVD
An issue was discovered in Ubuntu wpa_supplicant that resulted in loading of arbitrary shared objects, which allows a local unprivileged attacker to escalate privileges to the user that wpa_supplicant runs as (usually root).
Membership in the netdev group or access to the dbus interface of wpa_supplicant allow an unprivileged user to specify an arbitrary path to a module to be loaded by the wpa_supplicant process; other escalation paths might exist.
- Record
CVE-2024-5290- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-427
- Updated
- 2026-11-02
OSVBELL-CVE-2024-5290
- Record
BELL-CVE-2024-5290- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSV
An issue was discovered in Ubuntu wpa_supplicant that resulted in loading of arbitrary shared objects, which allows a local unprivileged attacker to escalate privileges to the user that wpa_supplicant runs as (usually root).
Membership in the netdev group or access to the dbus interface of wpa_supplicant allow an unprivileged user to specify an arbitrary path to a module to be loaded by the wpa_supplicant process; other escalation paths might exist.
- Record
CVE-2024-5290- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVDEBIAN-CVE-2024-5290
An issue was discovered in Ubuntu wpa_supplicant that resulted in loading of arbitrary shared objects, which allows a local unprivileged attacker to escalate privileges to the user that wpa_supplicant runs as (usually root). Membership in the netdev group or access to the dbus interface of wpa_supplicant allow an unprivileged user to specify an arbitrary path to a module to be loaded by the wpa_supplicant process; other escalation paths might exist.
- Record
DEBIAN-CVE-2024-5290- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2024-2142
wpa_supplicant security update
wpa_supplicant is a WPA Supplicant for Linux, BSD, Mac OS X, and Windows with support for WPA and WPA2 (IEEE 802.11i / RSN). It is suitable for both desktop/laptop computers and embedded systems. Supplicant is the IEEE 802.1X/WPA component that is used in the client stations. It implements key negotiation with a WPA Authenticator and it controls the roaming and IEEE 802.11 authentication/association of the wlan driver.
Security Fix(es):
An issue was discovered in Ubuntu wpa_supplicant that resulted in loading of arbitrary shared objects, which allows a local unprivileged attacker to escalate privileges to the user that wpa_supplicant runs as (usually root).
Membership in the netdev group or access to the dbus interface of wpa_supplicant allow an unprivileged user to specify an arbitrary path to a module to be loaded by the wpa_supplicant process; other escalation paths might exist.(CVE-2024-5290)
- Record
OESA-2024-2142- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-5290
An issue was discovered in Ubuntu wpa_supplicant that resulted in loading of arbitrary shared objects, which allows a local unprivileged attacker to escalate privileges to the user that wpa_supplicant runs as (usually root). Membership in the netdev group or access to the dbus interface of wpa_supplicant allow an unprivileged user to specify an arbitrary path to a module to be loaded by the wpa_supplicant process; other escalation paths might exist.
- Record
UBUNTU-CVE-2024-5290- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUSN-6945-1 No score
wpa vulnerability
Rory McNamara discovered that wpa_supplicant could be made to load arbitrary shared objects by unprivileged users that have access to the control interface. An attacker could use this to escalate privileges to root.
- Record
USN-6945-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
wpa_supplicantAlpaquita:23 |
2.10-r4 up to 2.10-r5 | 2.10-r5 |
wpa_supplicantAlpaquita:stream |
2.10-r4 up to 2.11-r0 | 2.11-r0 |
wpaDebian:12 |
before 2:2.10-12+deb12u2, plus listed versions 2:2.10-122:2.10-12+deb12u1 |
2:2.10-12+deb12u2 |
wpaDebian:13 |
before 2:2.10-22 | 2:2.10-22 |
wpaDebian:14 |
before 2:2.10-22 | 2:2.10-22 |
wpaDebian:11 |
before 2:2.9.0-21+deb11u2, plus listed versions 2:2.9.0-212:2.9.0-21+deb11u1 |
2:2.9.0-21+deb11u2 |
wpa_supplicantopenEuler:24.03-LTS |
before 2.10-7.oe2403 | 2.10-7.oe2403 |
wpa_supplicantopenEuler:22.03-LTS-SP4 |
before 2.6-32.oe2203sp4 | 2.6-32.oe2203sp4 |
wpa_supplicantopenEuler:22.03-LTS-SP3 |
before 2.6-32.oe2203sp3 | 2.6-32.oe2203sp3 |
wpa_supplicantopenEuler:20.03-LTS-SP4 |
before 2.6-32.oe2003sp4 | 2.6-32.oe2003sp4 |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
wpa_supplicantopenEuler:22.03-LTS-SP1 |
before 2.6-32.oe2203sp1 | 2.6-32.oe2203sp1 |
wpaUbuntu:14.04:LTS |
before 2.1-0ubuntu1.7+esm5, plus listed versions 1.0-3ubuntu21.0-3ubuntu31.0-3ubuntu42.1-0ubuntu12.1-0ubuntu1.1 Show 6 moreShow less2.1-0ubuntu1.22.1-0ubuntu1.32.1-0ubuntu1.42.1-0ubuntu1.52.1-0ubuntu1.62.1-0ubuntu1.7 |
2.1-0ubuntu1.7+esm5 |
wpaUbuntu:16.04:LTS |
before 2.4-0ubuntu6.8+esm1, plus listed versions 2.4-0ubuntu32.4-0ubuntu42.4-0ubuntu52.4-0ubuntu62.4-0ubuntu6.2 Show 6 moreShow less2.4-0ubuntu6.32.4-0ubuntu6.42.4-0ubuntu6.52.4-0ubuntu6.62.4-0ubuntu6.72.4-0ubuntu6.8 |
2.4-0ubuntu6.8+esm1 |
wpaUbuntu:18.04:LTS |
before 2:2.6-15ubuntu2.8+esm1, plus listed versions 2.4-0ubuntu102:2.4-1.1ubuntu12:2.6-15ubuntu12:2.6-15ubuntu22:2.6-15ubuntu2.1 Show 7 moreShow less2:2.6-15ubuntu2.22:2.6-15ubuntu2.32:2.6-15ubuntu2.42:2.6-15ubuntu2.52:2.6-15ubuntu2.62:2.6-15ubuntu2.72:2.6-15ubuntu2.8 |
2:2.6-15ubuntu2.8+esm1 |
wpaUbuntu:20.04:LTS |
before 2:2.9-1ubuntu4.4, plus listed versions 2:2.9-1ubuntu22:2.9-1ubuntu32:2.9-1ubuntu42:2.9-1ubuntu4.12:2.9-1ubuntu4.22:2.9-1ubuntu4.3 |
2:2.9-1ubuntu4.4 |
wpaUbuntu:22.04:LTS |
before 2:2.10-6ubuntu2.1, plus listed versions 2:2.9.0-21build12:2.9.0-232:2.10-12:2.10-22:2.10-62:2.10-6ubuntu12:2.10-6ubuntu2 |
2:2.10-6ubuntu2.1 |
wpaUbuntu:24.04:LTS |
before 2:2.10-21ubuntu0.1, plus listed versions 2:2.10-152:2.10-182:2.10-202:2.10-212:2.10-21build22:2.10-21build32:2.10-21build4 |
2:2.10-21ubuntu0.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-5290 is a high vulnerability (CVSS 8.8) in Canonical Ltd. Wpa Supplicant, published August 6, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.65%, the 51st percentile. Fixed in wpa_supplicant 2.10-r5.