Every CVESearch/Get API key

CVE-2014-3686

wpa_supplicant and hostapd 0.7.2 through 2.2, when running with certain configurations and using...

6.8 MediumFix available

CVE-2014-3686 is a medium vulnerability (CVSS 6.8) in W1.fi Hostapd, published October 9, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.95%, the 92nd percentile. Fixed in wpa 2.3-1.

What does this mean?
Severity
6.8 MediumCVSS 2.0, NVD
Exploit chance
4.95%EPSS, 92nd percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
2.3-1wpa +22 more

Description

wpa_supplicant and hostapd 0.7.2 through 2.2, when running with certain configurations and using wpa_cli or hostapd_cli with action scripts, allows remote attackers to execute arbitrary commands via a crafted frame.

Exploit likelihood

4.95%Up 1.2 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
wpa
Debian:12
before 2.3-1
2.3-1
wpa
Debian:13
before 2.3-1
2.3-1
wpa
Debian:14
before 2.3-1
2.3-1
wpasupplicant
Debian:6.0
before 0.6.10-2.1+deb6u1, plus listed versions
0.6.10-2.1
0.6.10-2.1+deb6u1
wpa
Debian:7
before 1.0-3+deb7u1, plus listed versions
1.0-3
1.0-3+deb7u1
wpa_supplicant
Mageia:3
before 1.1-4.1.mga3
1.1-4.1.mga3
hostapd
Mageia:3
before 1.1-2.1.mga3
1.1-2.1.mga3
wpa_supplicant
Mageia:4
before 2.0-2.1.mga4
2.0-2.1.mga4
hostapd
Mageia:4
before 2.0-2.1.mga4
2.0-2.1.mga4
wpa_supplicant
Red Hat:enterprise_linux:7::client
before 1:2.0-13.el7_0
1:2.0-13.el7_0
Show 13 moreShow less
Affected packages
PackageAffectedFixed
wpa_supplicant-debuginfo
Red Hat:enterprise_linux:7::client
before 1:2.0-13.el7_0
1:2.0-13.el7_0
wpa_supplicant
Red Hat:enterprise_linux:7::computenode
before 1:2.0-13.el7_0
1:2.0-13.el7_0
wpa_supplicant-debuginfo
Red Hat:enterprise_linux:7::computenode
before 1:2.0-13.el7_0
1:2.0-13.el7_0
wpa_supplicant
Red Hat:enterprise_linux:7::server
before 1:2.0-13.el7_0
1:2.0-13.el7_0
wpa_supplicant-debuginfo
Red Hat:enterprise_linux:7::server
before 1:2.0-13.el7_0
1:2.0-13.el7_0
wpa_supplicant
Red Hat:enterprise_linux:7::workstation
before 1:2.0-13.el7_0
1:2.0-13.el7_0
wpa_supplicant-debuginfo
Red Hat:enterprise_linux:7::workstation
before 1:2.0-13.el7_0
1:2.0-13.el7_0
wpa_supplicant
SUSE:Linux Enterprise Desktop 12
From an advisory covering 3 CVEs
before 2.2-8.1
2.2-8.1
wpa_supplicant
SUSE:Linux Enterprise Server 12
From an advisory covering 3 CVEs
before 2.2-8.1
2.2-8.1
wpa_supplicant
SUSE:Linux Enterprise Server for SAP Applications 12
From an advisory covering 3 CVEs
before 2.2-8.1
2.2-8.1
wpa
Ubuntu:14.04:LTS
before 2.1-0ubuntu1.1, plus listed versions
1.0-3ubuntu21.0-3ubuntu31.0-3ubuntu42.1-0ubuntu1
2.1-0ubuntu1.1
hostapd
openSUSE:Tumbleweed
From an advisory covering 9 CVEs
before 2.6-1.1
2.6-1.1
wpa_supplicant
openSUSE:Tumbleweed
From an advisory covering 13 CVEs
before 2.6-1.1
2.6-1.1

What each source reports

NVD Score used6.8

wpa_supplicant and hostapd 0.7.2 through 2.2, when running with certain configurations and using wpa_cli or hostapd_cli with action scripts, allows remote attackers to execute arbitrary commands via a crafted frame.

Record
CVE-2014-3686
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-20
Updated
2026-11-02
CVE ListNo score

wpa_supplicant and hostapd 0.7.2 through 2.2, when running with certain configurations and using wpa_cli or hostapd_cli with action scripts, allows remote attackers to execute arbitrary commands via a crafted frame.

Record
CVE-2014-3686
Updated
2026-11-02
EUVDEUVD-2014-3632No score

wpa_supplicant and hostapd 0.7.2 through 2.2, when running with certain configurations and using wpa_cli or hostapd_cli with action scripts, allows remote attackers to execute arbitrary commands via a crafted frame.

Record
EUVD-2014-3632
Updated
2026-11-03
GitHub AdvisoriesGHSA-mvf7-8vcg-m9vvNo score

wpa_supplicant and hostapd 0.7.2 through 2.2, when running with certain configurations and using...

wpa_supplicant and hostapd 0.7.2 through 2.2, when running with certain configurations and using wpa_cli or hostapd_cli with action scripts, allows remote attackers to execute arbitrary commands via a crafted frame.

Record
GHSA-mvf7-8vcg-m9vv
Weakness
CWE-20
Updated
2026-11-02
OSVNo score

wpa_supplicant and hostapd 0.7.2 through 2.2, when running with certain configurations and using wpa_cli or hostapd_cli with action scripts, allows remote attackers to execute arbitrary commands via a crafted frame.

Record
CVE-2014-3686
Updated
2026-11-02
OSVDEBIAN-CVE-2014-3686No score

wpa_supplicant and hostapd 0.7.2 through 2.2, when running with certain configurations and using wpa_cli or hostapd_cli with action scripts, allows remote attackers to execute arbitrary commands via a crafted frame.

Record
DEBIAN-CVE-2014-3686
Updated
2026-11-02
Show 6 moreShow less
OSVMGASA-2014-0429No score

Updated wpa_supplicant and hostapd packages fix security vulnerability

A vulnerability was found in the mechanism wpa_cli and hostapd_cli use for executing action scripts. An unsanitized string received from a remote device can be passed to a system() call resulting in arbitrary command execution under the privileges of the wpa_cli/hostapd_cli process (which may be root in common use cases) (CVE-2014-3686).

Using the Mageia wpa_supplicant package, systems are exposed to the vulnerability if operating as a WPS registrar.

The Mageia hostapd package was not vulnerable with the configuration with which it was built, but if a sysadmin had rebuilt it with WPS enabled, it would be vulnerable.

Record
MGASA-2014-0429
Updated
2026-11-02
OSVopenSUSE-SU-2024:10022-1No score

hostapd-2.6-1.1 on GA media

These are all security issues fixed in the hostapd-2.6-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10022-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10499-1No score

wpa_supplicant-2.6-1.1 on GA media

These are all security issues fixed in the wpa_supplicant-2.6-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10499-1
Updated
2026-11-02
OSVSUSE-SU-2015:1013-1No score

Security update for wpa_supplicant

wpa_supplicant was updated to fix three security issues:

  • CVE-2015-0210: wpa_supplicant: broken certificate subject check this adds the 'domain_match' config option from upstream (additional to the already existing domain_suffix_match)
  • CVE-2014-3686: hostapd command execution
  • CVE-2015-1863: P2P SSID processing vulnerability
Record
SUSE-SU-2015:1013-1
Updated
2026-11-02
OSVUBUNTU-CVE-2014-3686No score

wpa_supplicant and hostapd 0.7.2 through 2.2, when running with certain configurations and using wpa_cli or hostapd_cli with action scripts, allows remote attackers to execute arbitrary commands via a crafted frame.

Record
UBUNTU-CVE-2014-3686
Updated
2026-11-02
OSVUSN-2383-1No score

wpa, wpasupplicant vulnerability

Jouni Malinen discovered that the wpa_cli tool incorrectly sanitized strings when being used with action scripts. A remote attacker could possibly use this issue to execute arbitrary commands.

Record
USN-2383-1
Updated
2026-11-02

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 41 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open