{"id":"CVE-2015-5310","aliases":["DEBIAN-CVE-2015-5310","DSA-3397-1","EUVD-2015-5282","GHSA-w9vx-28m4-g24h","SUSE-SU-2016:2305-1","UBUNTU-CVE-2015-5310","USN-2808-1","openSUSE-SU-2024:10499-1"],"status":"published","title":"The WNM Sleep Mode code in wpa_supplicant 2.x before 2.6 does not properly ignore key data in...","description":"The WNM Sleep Mode code in wpa_supplicant 2.x before 2.6 does not properly ignore key data in response frames when management frame protection (MFP) was not negotiated, which allows remote attackers to inject arbitrary broadcast or multicast packets or cause a denial of service (ignored packets) via a WNM Sleep Mode response.","severity":{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01176,"percentile":0.67761,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2015-11-10T00:00:00Z","modified":"2026-09-09T07:01:20Z","fixes":[{"ecosystem":"Debian:12","package":"wpa","fixed_in":["2.3-2.3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"wpa","fixed_in":["2.3-2.3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"wpa","fixed_in":["2.3-2.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"wpa","fixed_in":["2.1-0ubuntu1.4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"wpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3-2.3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"wpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3-2.3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"wpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3-2.3"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"wpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0-3+deb7u3"}]}],"versions":["1.0-3","1.0-3+deb7u1","1.0-3+deb7u2"],"bundled":11},{"source":"osv","ecosystem":"Debian:8","package":"wpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3-1+deb8u3"}]}],"versions":["2.3-1","2.3-1+deb8u1","2.3-1+deb8u2"],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"wpa_supplicant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2-14.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"wpa_supplicant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2-14.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"wpa_supplicant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2-14.2"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"wpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1-0ubuntu1.4"}]}],"versions":["1.0-3ubuntu2","1.0-3ubuntu3","1.0-3ubuntu4","2.1-0ubuntu1","2.1-0ubuntu1.1","2.1-0ubuntu1.2","2.1-0ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"wpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1-0ubuntu1.4"}]}],"versions":["1.0-3ubuntu2","1.0-3ubuntu3","1.0-3ubuntu4","2.1-0ubuntu1","2.1-0ubuntu1.1","2.1-0ubuntu1.2","2.1-0ubuntu1.3"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"wpa_supplicant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6-1.1"}]}],"bundled":13}],"products":[{"vendor":"google","product":"android"}],"references":[{"url":"http://www.ubuntu.com/usn/USN-2808-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://www.securitytracker.com/id/1034592","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"http://w1.fi/security/2015-6/wpa_supplicant-unauthorized-wnm-sleep-mode-gtk-control.txt","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://source.android.com/security/bulletin/2016-01-01.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"http://www.debian.org/security/2015/dsa-3397","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://www.securityfocus.com/bid/77541","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2015/11/10/9","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5310"},{"url":"https://github.com/advisories/GHSA-w9vx-28m4-g24h"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-5310","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162305-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/930077","tags":["report"]},{"url":"https://bugzilla.suse.com/930078","tags":["report"]},{"url":"https://bugzilla.suse.com/930079","tags":["report"]},{"url":"https://bugzilla.suse.com/937419","tags":["report"]},{"url":"https://bugzilla.suse.com/952254","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4141","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4142","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5310","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8041","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2015-5310","tags":["report"]},{"url":"http://w1.fi/security/2015-6/","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2808-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-5310","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-5314","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-5315","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-5316","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3686","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1863","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4144","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4145","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4146","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5315","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5316","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4476","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4477","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2015-5310","description":"The WNM Sleep Mode code in wpa_supplicant 2.x before 2.6 does not properly ignore key data in response frames when management frame protection (MFP) was not negotiated, which allows remote attackers to inject arbitrary broadcast or multicast packets or cause a denial of service (ignored packets) via a WNM Sleep Mode response.","status":"published","published":"2016-01-06T19:00:00Z","modified":"2024-08-06T06:41:09.281Z","updated_at":"2026-11-02T14:35:40.217028Z"}],"euvd":[{"id":"EUVD-2015-5282","description":"The WNM Sleep Mode code in wpa_supplicant 2.x before 2.6 does not properly ignore key data in response frames when management frame protection (MFP) was not negotiated, which allows remote attackers to inject arbitrary broadcast or multicast packets or cause a denial of service (ignored packets) via a WNM Sleep Mode response.","status":"published","published":"2016-01-06T19:00:00Z","modified":"2024-08-06T06:41:09Z","updated_at":"2026-11-03T02:22:00.863884Z"}],"ghsa":[{"id":"GHSA-w9vx-28m4-g24h","title":"The WNM Sleep Mode code in wpa_supplicant 2.x before 2.6 does not properly ignore key data in...","description":"The WNM Sleep Mode code in wpa_supplicant 2.x before 2.6 does not properly ignore key data in response frames when management frame protection (MFP) was not negotiated, which allows remote attackers to inject arbitrary broadcast or multicast packets or cause a denial of service (ignored packets) via a WNM Sleep Mode response.","status":"published","published":"2022-05-14T03:44:08Z","modified":"2023-02-02T05:10:06Z","cvss":[{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:52:46.933473Z"}],"nvd":[{"id":"CVE-2015-5310","description":"The WNM Sleep Mode code in wpa_supplicant 2.x before 2.6 does not properly ignore key data in response frames when management frame protection (MFP) was not negotiated, which allows remote attackers to inject arbitrary broadcast or multicast packets or cause a denial of service (ignored packets) via a WNM Sleep Mode response.","status":"published","published":"2016-01-06T19:59:00.11Z","modified":"2026-06-17T00:28:54.293Z","cvss":[{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.3,"vector":"AV:A/AC:L/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:03:15.746629Z"}],"osv":[{"id":"CVE-2015-5310","description":"The WNM Sleep Mode code in wpa_supplicant 2.x before 2.6 does not properly ignore key data in response frames when management frame protection (MFP) was not negotiated, which allows remote attackers to inject arbitrary broadcast or multicast packets or cause a denial of service (ignored packets) via a WNM Sleep Mode response.","status":"published","published":"2016-01-06T19:59:00Z","modified":"2026-04-10T03:45:22.088519Z","cvss":[{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:00.594921Z"},{"id":"DEBIAN-CVE-2015-5310","description":"The WNM Sleep Mode code in wpa_supplicant 2.x before 2.6 does not properly ignore key data in response frames when management frame protection (MFP) was not negotiated, which allows remote attackers to inject arbitrary broadcast or multicast packets or cause a denial of service (ignored packets) via a WNM Sleep Mode response.","status":"published","published":"2016-01-06T19:59:00.11Z","modified":"2026-09-09T07:01:20.426170388Z","cvss":[{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:26.752992Z"},{"id":"UBUNTU-CVE-2015-5310","description":"The WNM Sleep Mode code in wpa_supplicant 2.x before 2.6 does not properly ignore key data in response frames when management frame protection (MFP) was not negotiated, which allows remote attackers to inject arbitrary broadcast or multicast packets or cause a denial of service (ignored packets) via a WNM Sleep Mode response.","status":"published","published":"2015-11-10T00:00:00Z","modified":"2026-02-04T03:26:05.067514Z","cvss":[{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:10.385269Z"},{"id":"DSA-3397-1","title":"wpa - security update","status":"published","published":"2015-11-10T00:00:00Z","modified":"2026-03-09T01:22:49.047381Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"openSUSE-SU-2024:10499-1","title":"wpa_supplicant-2.6-1.1 on GA media","description":"These are all security issues fixed in the wpa_supplicant-2.6-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:27:03.526024Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2016:2305-1","title":"Security update for wpa_supplicant","description":"\nThis update for wpa_supplicant fixes the following issues:\n\n- CVE-2015-4141: WPS UPnP vulnerability with HTTP chunked transfer encoding. (bnc#930077)\n- CVE-2015-4142: Integer underflow in AP mode WMM Action frame processing.  (bnc#930078)\n- CVE-2015-4143: EAP-pwd missing payload length validation. (bnc#930079) \n- CVE-2015-5310: Ignore Key Data in WNM Sleep Mode Response frame if no PMF in use. (bsc#952254)\n- CVE-2015-8041: Fix payload length validation in NDEF record parser. (bsc#937419)\n","status":"published","published":"2016-09-14T13:37:15Z","modified":"2026-02-04T02:52:14.022664Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"USN-2808-1","title":"wpa vulnerabilities","description":"It was discovered that wpa_supplicant incorrectly handled WMM Sleep Mode\nResponse frame processing. A remote attacker could use this issue to\nperform broadcast/multicast packet injections, or cause a denial of\nservice. (CVE-2015-5310)\n\nIt was discovered that wpa_supplicant and hostapd incorrectly handled\ncertain EAP-pwd messages. A remote attacker could use this issue to cause a\ndenial of service. (CVE-2015-5314, CVE-2015-5315)\n\nIt was discovered that wpa_supplicant incorrectly handled certain EAP-pwd\nConfirm messages. A remote attacker could use this issue to cause a\ndenial of service. This issue only applied to Ubuntu 15.10. (CVE-2015-5316)\n","status":"published","published":"2015-11-10T18:10:11Z","modified":"2026-02-10T04:40:56Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}