CVE-2022-37660
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
In hostapd version 2.10 and earlier, the PKEX code remains active even after a successful PKEX association. An attacker who previously successfully bootstrapped public keys with another entity using PKEX can subvert future bootstrapping by passively observing public keys, reusing the encrypting element Qi and subtracting it from the captured message M (X = M - Qi). This yields the public ephemeral key X, the only element required to subvert the PKEX association.
Risk Assessment
The risk involves an attacker being able to hijack the PKEX authentication process, potentially leading to unauthorized network access or eavesdropping on communications.
Recommendation
It is recommended to immediately upgrade hostapd to version 2.11 or later, which includes a fix for this vulnerability.
Original NVD description (English source)
In hostapd 2.10 and earlier, the PKEX code remains active even after a successful PKEX association. An attacker that successfully bootstrapped public keys with another entity using PKEX in the past, will be able to subvert a future bootstrapping by passively observing public keys, re-using the encrypting element Qi and subtracting it from the captured message M (X = M - Qi). This will result in the public ephemeral key X; the only element required to subvert the PKEX association.