CVE-2015-5316

The eap_pwd_perform_confirm_exchange function in eap_peer/eap_pwd.c in wpa_supplicant 2.x before 2.6, when EAP-pwd is enabled in a network configuration profile, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an EAP-pwd Confirm message followed by the Identity exchange.

• CWE-476

• http://w1.fi/security/2015-8/eap-pwd-unexpected-confirm.txtMitigation, Patch, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2015/11/10/11Mailing List, Mitigation, Patch, Third Party Advisory
• http://www.securityfocus.com/bid/77538Third Party Advisory, VDB Entry
• http://www.ubuntu.com/usn/USN-2808-1Broken Link
• https://www.debian.org/security/2015/dsa-3397Third Party Advisory
• http://w1.fi/security/2015-8/eap-pwd-unexpected-confirm.txtMitigation, Patch, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2015/11/10/11Mailing List, Mitigation, Patch, Third Party Advisory
• http://www.securityfocus.com/bid/77538Third Party Advisory, VDB Entry
• http://www.ubuntu.com/usn/USN-2808-1Broken Link
• https://www.debian.org/security/2015/dsa-3397Third Party Advisory

Published

Feb 21, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-5310The WNM Sleep Mode code in wpa_supplicant 2.x before 2.6 doe…
• CVE-2015-5311PowerDNS (aka pdns) Authoritative Server 3.4.4 before 3.4.7 …
• CVE-2015-5312The xmlStringLenDecodeEntities function in parser.c in libxm…
• CVE-2015-5313Directory traversal vulnerability in the virStorageBackendFi…
• CVE-2015-5314The eap_pwd_process function in eap_server/eap_server_pwd.c …
• CVE-2015-5315The eap_pwd_process function in eap_peer/eap_pwd.c in wpa_su…
• CVE-2015-5317The Fingerprints pages in Jenkins before 1.638 and LTS befor…7.5
• CVE-2015-5318Jenkins before 1.638 and LTS before 1.625.2 uses a publicly …
• CVE-2015-5319XML external entity (XXE) vulnerability in the create-job CL…
• CVE-2015-5320Jenkins before 1.638 and LTS before 1.625.2 do not properly …
• CVE-2015-5321The sidepanel widgets in the CLI command overview and help p…
• CVE-2015-5322Directory traversal vulnerability in Jenkins before 1.638 an…