W1.Fi maintains the widely embedded hostapd and wpa_supplicant projects, which form the foundation of Wi-Fi Protected Access (WPA) authentication and access-point functionality across Linux-based systems, embedded devices, and network infrastructure. The vendor's vulnerability footprint, though modest in volume, is strategically significant because these components sit at the authentication boundary between wireless clients and networks, giving defects in cryptographic implementation and protocol handling outsized security impact. The recurring weakness classes center on cryptographic weaknesses—particularly insufficient randomness, nonce reuse, and key-handling errors—alongside memory-safety and authentication-logic issues that are endemic to low-level wireless security implementations. Defenders should monitor this vendor's releases closely despite the narrow product portfolio, as patches often address fundamental protocol or implementation flaws that affect every downstream deployment; current severity and exploitation data are shown alongside this summary.
The number and severity of CVEs published that impact products developed by W1.Fi over time
Signals from CVEs in this vendor scope (50 CVEs).
50 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-23303CRITICAL The implementations of SAE in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side channel attacks as a result of cache access patterns. NOTE: this issue exist | Jan 17, 2022 | 9.8 | 36 | NO | NO |
CVE-2022-23304CRITICAL The implementations of EAP-pwd in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side-channel attacks as a result of cache access patterns. NOTE: this issue e | Jan 17, 2022 | 9.8 | 34 | NO | NO |
CVE-2026-58374HIGH In hostapd before 2.12, a missing bounds check in AP-mode Wi-Fi 7 (IEEE 802.11be) Multi-Link Operation (MLO) association request processing allows an unauthenticated attacker withi | Jun 30, 2026 | 7.1 | 32 | NO | NO |
CVE-2020-12695HIGH The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different network segment th | Jun 8, 2020 | 7.5 | 28 | NO | NO |
CVE-2017-13082HIGH Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11r allows reinstallation of the Pairwise Transient Key (PTK) Temporal Key (TK) during the fast BSS transmission (FT) h | Oct 17, 2017 | 8.1 | 28 | NO | NO |
CVE-2019-10064HIGH hostapd before 2.6, in EAP mode, makes calls to the rand() and random() standard library functions without any preceding srand() or srandom() call, which results in inappropriate u | Feb 28, 2020 | 7.5 | 26 | NO | NO |
CVE-2016-10743HIGH hostapd before 2.6 does not prevent use of the low-quality PRNG that is reached by an os_random() function call. | Mar 23, 2019 | 7.5 | 26 | NO | NO |
CVE-2016-4476HIGH hostapd 0.6.7 through 2.5 and wpa_supplicant 0.6.7 through 2.5 do not reject \n and \r characters in passphrase parameters, which allows remote attackers to cause a denial of servi | May 9, 2016 | 7.5 | 26 | NO | NO |
CVE-2024-5290HIGH An issue was discovered in Ubuntu wpa_supplicant that resulted in loading of arbitrary shared objects, which allows a local unprivileged attacker to escalate privileges to the user | Aug 7, 2024 | 7.8 | 25 | NO | NO |
CVE-2021-27803HIGH A vulnerability was discovered in how p2p/p2p_pd.c in wpa_supplicant before 2.10 processes P2P (Wi-Fi Direct) provision discovery requests. It could result in denial of service or | Feb 26, 2021 | 7.5 | 24 | NO | NO |
Signals from CVEs in this vendor scope (50 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by W1.Fi.
Media articles that mention a CVE ID that affects a product developed by W1.Fi — matched by CVE ID, not by vendor name.