CVE-2019-9494

Name: CVE-2019-9494
Creator: NVD / NIST
Published: 2019-04-17T14:29:03.84+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

MEDIUMCVSS 5.9/10EPSS 3.74%

Last modified Jun 17, 2026

CVE-2019-9494 is a medium-severity vulnerability rated 5.9/10 on the CVSS scale. The implementations of SAE in hostapd and wpa_supplicant are vulnerable to side channel attacks as a result of observable timing differences and cache access patterns. An attacker may be able to gain leaked information from a side channel attack that can be used for full password recovery. EPSS estimates a 3.74% chance of exploitation in the next 30 days.

Description

The implementations of SAE in hostapd and wpa_supplicant are vulnerable to side channel attacks as a result of observable timing differences and cache access patterns. An attacker may be able to gain leaked information from a side channel attack that can be used for full password recovery. Both hostapd with SAE support and wpa_supplicant with SAE support prior to and including version 2.7 are affected.

Metrics

CVSS 3.1

5.9/10

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Probability

3.74%

88.5th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
W1.Fi	Hostapd	<= 2.7
W1.Fi	Wpa Supplicant	<= 2.7
Fedoraproject	Fedora	28
Fedoraproject	Fedora	29
Fedoraproject	Fedora	30
Opensuse	Backports Sle	15.0
Opensuse	Leap	15.1
Synology	Radius Server	3.0
Synology	Router Manager	< 1.2.3-8087
Freebsd	Freebsd	11.2
Freebsd	Freebsd	12.0

References

http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00021.htmlMailing List, Third Party Advisory
http://packetstormsecurity.com/files/152914/FreeBSD-Security-Advisory-FreeBSD-SA-19-03.wpa.htmlThird Party Advisory, VDB Entry
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/56OBBOJJSKRTDGEXZOVFSTP4HDSDBLAE/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVMJOFEYBGXZLFF5IOLW67SSOPKFEJP3/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TDOZGR3T7FVO5JSZWK2QPR7AOFIEJTIZ/
https://seclists.org/bugtraq/2019/May/40Mailing List, Third Party Advisory
https://security.FreeBSD.org/advisories/FreeBSD-SA-19:03.wpa.ascThird Party Advisory
https://w1.fi/security/2019-1/Patch, Vendor Advisory
https://www.synology.com/security/advisory/Synology_SA_19_16Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00021.htmlMailing List, Third Party Advisory
http://packetstormsecurity.com/files/152914/FreeBSD-Security-Advisory-FreeBSD-SA-19-03.wpa.htmlThird Party Advisory, VDB Entry
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/56OBBOJJSKRTDGEXZOVFSTP4HDSDBLAE/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVMJOFEYBGXZLFF5IOLW67SSOPKFEJP3/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TDOZGR3T7FVO5JSZWK2QPR7AOFIEJTIZ/
https://seclists.org/bugtraq/2019/May/40Mailing List, Third Party Advisory
https://security.FreeBSD.org/advisories/FreeBSD-SA-19:03.wpa.ascThird Party Advisory
https://w1.fi/security/2019-1/Patch, Vendor Advisory
https://www.synology.com/security/advisory/Synology_SA_19_16Third Party Advisory

Timeline

Published: Apr 17, 2019
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2019-9494?

How severe is CVE-2019-9494?

CVE-2019-9494 has a CVSS score of 5.9/10 (MEDIUM severity). The EPSS model estimates a 3.74% probability of exploitation in the next 30 days.

How do I fix CVE-2019-9494?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2019-9494?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST