CVE-2025-24912

Vulnerability

hostapd versions 2.11 and earlier fail to properly process crafted RADIUS packets [1][2]. This issue resides in the RADIUS client component used when authenticating Wi-Fi devices with an external RADIUS authentication server. The vulnerability is classified as CWE-826 (Premature Release of Resource During Expected Lifetime) [2].

Exploitation

An attacker must be positioned in a man-in-the-middle (MITM) role between the hostapd instance and the RADIUS server [2]. No authentication is required, but the attacker needs network access to the communication path. By injecting specially crafted RADIUS packets, the attacker can force RADIUS authentication attempts to fail [2].

Impact

Successful exploitation results in a denial of service (DoS) condition where legitimate Wi-Fi clients are unable to complete RADIUS authentication, preventing network access [2]. The impact is limited to availability; no confidentiality or integrity compromise is reported.

Mitigation

The developer has provided patches to address this vulnerability [2]. Users should apply the patches as indicated in the vendor status section of the advisory [2]. No workarounds are documented. The fixed version is not explicitly stated, but upgrading to the latest hostapd release is recommended.