CVE-2019-9497

CVE-2019-9497 describes a critical vulnerability in the EAP-PWD implementations of hostapd EAP Server and wpa_supplicant EAP Peer, affecting versions up to and including 2.7, and SAE-enabled versions up to 2.4. The flaw stems from insufficient validation of scalar and element values in EAP-pwd-Commit, potentially allowing an attacker to bypass authentication without knowing the password. This vulnerability carries a high CVSS score of 8.1, indicating a network-based attack with high impact on confidentiality, integrity, and availability, though successful key exchange is contingent on the crypto library's EC point checks. While the EPSS score is low and there is no evidence of active exploitation, public exploit code, or significant community discussion, the potential for unauthorized access remains a concern.