CVE-2022-23304

CriticalCVSS 9.8

Published: 17/01/2022(UTC)Updated: 14/07/2026(UTC)Translated: 15/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

1.90%

77th percentile - higher than 77% of all known CVEs

Summary

The EAP-pwd implementations in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side-channel attacks due to cache access patterns. This issue exists because of an incomplete fix for CVE-2019-9495.

Risk Assessment

An attacker can exploit this vulnerability to recover passwords or authentication keys, leading to a breach of confidentiality and integrity of network communications.

Recommendation

Immediately update hostapd and wpa_supplicant to version 2.10 or later, which includes a complete fix eliminating the side-channel vulnerability.

Original NVD description (English source)

The implementations of EAP-pwd in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side-channel attacks as a result of cache access patterns. NOTE: this issue exists because of an incomplete fix for CVE-2019-9495.