6.8 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
0.015 Low
EPSS
Percentile
87.3%
A vulnerability was found in the mechanism wpa_cli and hostapd_cli use for executing action scripts. An unsanitized string received from a remote device can be passed to a system() call resulting in arbitrary command execution under the privileges of the wpa_cli/hostapd_cli process (which may be root in common use cases) (CVE-2014-3686). Using the Mageia wpa_supplicant package, systems are exposed to the vulnerability if operating as a WPS registrar. The Mageia hostapd package was not vulnerable with the configuration with which it was built, but if a sysadmin had rebuilt it with WPS enabled, it would be vulnerable.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Mageia | 3 | noarch | wpa_supplicant | < 1.1-4.1 | wpa_supplicant-1.1-4.1.mga3 |
Mageia | 3 | noarch | hostapd | < 1.1-2.1 | hostapd-1.1-2.1.mga3 |
Mageia | 4 | noarch | wpa_supplicant | < 2.0-2.1 | wpa_supplicant-2.0-2.1.mga4 |
Mageia | 4 | noarch | hostapd | < 2.0-2.1 | hostapd-2.0-2.1.mga4 |