WPAxFuzz

Un Fuzzer Wi-Fi completo Reportar un error · Solicitar una característica Tabla de contenidos 1. Acerca del proyecto 2. Fuzzing de tramas de gestión, control y datos Requisitos y dependencias Descripción 3. Fuzzing del intercambio SAE 4. Módulo de ataque DoS Descripción 5. Vulnerabilidades 6...

bcm4360-wpa3

WPA3-SAE + 802.11w en el Broadcom BCM4360 blob wl cerrado Apple/Broadcom nunca le dio al BCM4360 14e4:43a0 WPA3. Su único controlador para Linux es el blob cerrado broadcom-sta wl; brcmfmac no puede manejarlo. Esto añade WPA3-SAE + PMF 802.11w completo a ese blob cerrado — enteramente desde...

CVE-2026-72003

A flaw was found in the Linux kernel's brcmfmac Wi-Fi driver. A remote attacker, by sending a specially crafted short authentication frame during the SAE Simultaneous Authentication of Equals authentication exchange, could trigger a heap overflow. This vulnerability allows for potential arbitrary...

CVE-2026-72003

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: cyw: fix heap overflow on a short auth frame brcmfnotifyauthframerx takes the frame length from the firmware event and copies the frame body with the management header offset subtracted: u32 mgmtframelen = e-datal...

UBUNTU-CVE-2026-72003

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: cyw: fix heap overflow on a short auth frame brcmfnotifyauthframerx takes the frame length from the firmware event and copies the frame body with the management header offset subtracted: u32 mgmtframelen = e-datal...

CVE-2026-72003

CVE-2026-72003 observable in the Linux kernel affects the brcmfmac cyw WLAN driver. The issue arises in brcmf_notify_auth_frame_rx(), where the code derives mgmt_frame_len from e->datalen and subtracts offsetof(struct ieee80211_mgmt, u). If mgmt_frame_len is smaller than the 24-byte header off...

PT-2026-72192

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: cyw: fix heap overflow on a short auth frame brcmf notify auth frame rx takes the frame length from the firmware event and copies the frame body with the management header offset subtracted: u32 mgmt frame len =...

SUSE-SU-2026:23072-1 Security update for wpa_supplicant

This update for wpasupplicant fixes the following issues: Security issues fixed: - CVE-2025-24912: RADIUS pending request dropping bsc1239461. - CVE-2026-58374: missing bounds check in AP-mode Wi-Fi 7 IEEE 802.11be MLO association request processing allows an unauthenticated user to send a crafte...

SUSE-SU-2026:3103-1 Security update for wpa_supplicant

This update for wpasupplicant fixes the following issues: - CVE-2025-24912: hostapd RADIUS authentication of wi-fi devices allows a user in between the hostapd and the RADIUS server to inject crafted RADIUS packets and force RADIUS authentications to fail bsc1239461. - CVE-2026-58374: missing...

CVE-2026-42467

An issue was discovered in Open-SAE-J1939 thru commit b6caf884df46435e539b1ecbf92b6c29b345bdfe 2025-11-30 in SAEJ1939ReadBinaryDataTransferDM16 causing a denial of service via crafted CAN frame on the J1939 bus...

CVE-2026-37534

Integer underflow vulnerability in Open-SAE-J1939 thru commit b6caf884df46435e539b1ecbf92b6c29b345bdfe 2025-11-30 in SAEJ1939ReadTransportProtocolDataTransfer,allows attackers to write to arbitrary memory via crafted sequence number from the CAN frame...

Astra Linux – Vulnerability in wpa

Implementations of SAE in hostapd before version 2.10, and wpasupplicant before version 2.10, are vulnerable to side-channel attacks due to cache access patterns. NOTE: This issue exists due to an incomplete fix for CVE-2019-9494...

CVE-2026-42467

An issue was discovered in Open-SAE-J1939 thru commit b6caf884df46435e539b1ecbf92b6c29b345bdfe 2025-11-30 in SAEJ1939ReadBinaryDataTransferDM16 causing a denial of service via crafted CAN frame on the J1939 bus...

CVE-2026-37534

Integer underflow vulnerability in Open-SAE-J1939 thru commit b6caf884df46435e539b1ecbf92b6c29b345bdfe 2025-11-30 in SAEJ1939ReadTransportProtocolDataTransfer,allows attackers to write to arbitrary memory via crafted sequence number from the CAN frame...

CVE-2026-37537

collin80/Open-SAE-J1939 thru commit 744024d4306bc387857dfce439558336806acb06 2023-03-08 contains an integer underflow leading to out-of-bounds write in Transport Protocol Data Transfer handling. At line 23: uint8t index = data0 - 1. When data0 sequence number from CAN frame is 0, index underflows...

CVE-2026-37534

Integer underflow vulnerability in Open-SAE-J1939 thru commit b6caf884df46435e539b1ecbf92b6c29b345bdfe 2025-11-30 in SAEJ1939ReadTransportProtocolDataTransfer,allows attackers to write to arbitrary memory via crafted sequence number from the CAN frame...

CVE-2026-42467

An issue was discovered in Open-SAE-J1939 thru commit b6caf884df46435e539b1ecbf92b6c29b345bdfe 2025-11-30 in SAEJ1939ReadBinaryDataTransferDM16 causing a denial of service via crafted CAN frame on the J1939 bus...

CVE-2026-37537

collin80/Open-SAE-J1939 thru commit 744024d4306bc387857dfce439558336806acb06 2023-03-08 contains an integer underflow leading to out-of-bounds write in Transport Protocol Data Transfer handling. At line 23: uint8t index = data0 - 1. When data0 sequence number from CAN frame is 0, index underflows...

PT-2026-36508

Name of the Vulnerable Software and Affected Versions Open-SAE-J1939 versions prior to commit b6caf884df46435e539b1ecbf92b6c29b345bdfe Description An integer underflow exists in the SAE J1939 Read Transport Protocol Data Transfer function. This allows attackers to write to arbitrary memory by usi...

CVE-2026-37534

Integer underflow vulnerability in Open-SAE-J1939 thru commit b6caf884df46435e539b1ecbf92b6c29b345bdfe 2025-11-30 in SAEJ1939ReadTransportProtocolDataTransfer,allows attackers to write to arbitrary memory via crafted sequence number from the CAN frame...