VYPR
← All advisories
Unrated severityNVD Advisory· Published Apr 17, 2019· Updated Aug 4, 2024

The implementations of SAE in hostapd and wpa_supplicant are vulnerable to side-channel attacks

CVE-2019-9494

Description

Side-channel attacks in SAE implementations of hostapd and wpa_supplicant allow password recovery via timing and cache observations.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Side-channel attacks in SAE implementations of hostapd and wpa_supplicant allow password recovery via timing and cache observations.

Vulnerability

The implementations of SAE (Simultaneous Authentication of Equals) in hostapd and wpa_supplicant are vulnerable to side-channel attacks due to observable timing differences and cache access patterns. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.7 are affected [1][2].

Exploitation

An attacker with close network proximity (e.g., within wireless range) can perform side-channel analysis by measuring response times or observing cache behavior during SAE handshakes. No authentication is required, but the attacker must be able to interact with the target device to trigger the handshake [1][2].

Impact

Successful exploitation allows the attacker to leak information about the SAE password, potentially leading to full password recovery. This compromises the confidentiality of the wireless network credentials, enabling unauthorized network access [1].

Mitigation

Updates are available: for hostapd/wpa_supplicant, upgrade to version 2.8 or later. Synology SRM users should upgrade to SRM 1.2.3-8017 or apply a patch for SRM 1.2.1 [1]. FreeBSD users should update to fixed versions as per FreeBSD-SA-19:03.wpa [2]. No workaround is available for systems using affected software [2].

References
  1. Synology_SA_19_16 | Synology Inc.
  2. https://security.FreeBSD.org/advisories/FreeBSD-SA-19:03.wpa.asc

AI Insight generated on May 26, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

30

Patches

0

No patches discovered yet.

Vulnerability mechanics

No source-code context for this CVE — mechanics is only generated when we can read the actual fix diff. Without that, the four sections (root cause, attack vector, affected code, fix) would be speculation rather than analysis.

References

9

News mentions

0

No linked articles in our index yet.