CVE-2026-23444 is a high-severity vulnerability in the Linux kernel's mac80211 wireless subsystem. The function ieee80211_tx_prepare_skb() has inconsistent handling of socket buffers (skb) on error paths, leading to a potential use-after-free or memory leak. The issue was fixed by ensuring skb is always freed on all error paths, preventing double-free and memory management errors.
A vulnerability in the processing of Control and Provisioning of Wireless Access Points (CAPWAP) packets of Cisco IOS XE Wireless Controller Software for the Catalyst CW9800 Family could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.
This vulnerability is due to improper handling of a malformed CAPWAP packet. An attacker could exploit this vulnerability by sending a malformed CAPWAP packet to an affected device. A successful exploit could allow the attacker to cause the affected device to reload unexpectedly, resulting in a DoS condition.
A use-after-free vulnerability in the Linux kernel's cfg80211 wireless subsystem was resolved by cancelling the rfkill_block work during wiphy unregistration. The flaw was identified by syzkaller and could lead to kernel memory corruption. Multiple specific Linux kernel versions are affected. A patch is available and has been incorporated into Linux kernel updates.
A vulnerability has been identified where an attacker connecting to an access point as a standard wired or wireless client can impersonate a gateway by leveraging an address-based spoofing technique. Successful exploitation enables the redirection of data streams, allowing for the interception or modification of traffic intended for the legitimate network gateway via a Machine-in-the-Middle (MitM) position.
A vulnerability in the client isolation mechanism may allow an attacker to bypass Layer 2 (L2) communication restrictions between clients and redirect traffic at Layer 3 (L3). In addition to bypassing policy enforcement, successful exploitation - when combined with a port-stealing attack - may enable a bi-directional Machine-in-the-Middle (MitM) attack.
A vulnerability in the packet processing logic may allow an authenticated attacker to craft and transmit a malicious Wi-Fi frame that causes an Access Point (AP) to classify the frame as group-addressed traffic and re-encrypt it using the Group Temporal Key (GTK) associated with the victim's BSSID. Successful exploitation may enable GTK-independent traffic injection and, when combined with a port-stealing technique, allows an attacker to redirect intercepted traffic to facilitate machine-in-the-middle (MitM) attacks across BSSID boundaries.
A technique has been identified that adapts a known port-stealing method to Wi-Fi environments that use multiple BSSIDs. By leveraging the relationship between BSSIDs and their associated virtual ports, an attacker could potentially bypass inter-BSSID isolation controls. Successful exploitation may enable an attacker to redirect and intercept the victim's network traffic, potentially resulting in eavesdropping, session hijacking, or denial of service.
A vulnerability has been identified in a standardized wireless roaming protocol that could enable a malicious actor to install an attacker-controlled Group Temporal Key (GTK) on a client device. Successful exploitation of this vulnerability could allow a remote malicious actor to perform unauthorized frame injection, bypass client isolation, interfere with cross-client traffic, and compromise network segmentation, integrity, and confidentiality.
A vulnerability has been identified in the wireless encryption handling of Wi-Fi transmissions. A malicious actor can generate shared-key authenticated transmissions containing targeted payloads while impersonating the identity of a primary BSSID.Successful exploitation allows for the delivery of tampered data to specific endpoints, bypassing standard cryptographic separation.
Shenzhen Tenda F3 Wireless Router firmware V12.01.01.55_multi contains a sensitive information exposure vulnerability in the configuration download functionality. The configuration download response includes the router password and administrative password in plaintext. The endpoint also omits appropriate Cache-Control directives, which can allow the response to be stored in client-side caches and recovered by other local users or processes with access to cached browser data.
A vulnerability in the Linux kernel's mac80211 wireless subsystem related to the OCB (Outside Context of a BSS) mode was resolved. The flaw involved the function ieee80211_ocb_rx_no_sta() assuming a valid channel context, which may not be present if the interface is not joined, potentially causing warnings in the receive path. This issue has been fixed by skipping RX peer handling when the interface is not joined. The vulnerability affects certain Linux kernel versions prior to specific patched releases. A patch is available as part of a broader Linux kernel security update.
CVE-2026-24788 is a high-severity OS command injection vulnerability in raspap-webgui versions prior to 3.3.6. It allows an authenticated user with login access to execute arbitrary OS commands due to improper neutralization of special elements. The vulnerability has a CVSS score of 8.8, indicating critical impacts on confidentiality, integrity, and availability without requiring user interaction. Exploitation could lead to full system compromise of devices running the vulnerable RaspAP web interface. Although no known exploits are currently reported in the wild, the ease of exploitation and potential damage make timely patching essential. European organizations using RaspAP for wireless access point management, especially in sectors relying on Raspberry Pi devices, are at risk. Countries with higher adoption of Raspberry Pi-based network solutions and critical infrastructure deployments are more likely to be affected.
Some Hikvision Wireless Access Points are vulnerable to authenticated command execution due to insufficient input validation. Attackers with valid credentials can exploit this flaw by sending crafted packets containing malicious commands to affected devices, leading to arbitrary command execution.
A vulnerability in the SSH service of Cisco IEC6400 Wireless Backhaul Edge Compute Software could allow an unauthenticated, remote attacker to cause the SSH service to stop responding.
This vulnerability exists because the SSH service lacks effective flood protection. An attacker could exploit this vulnerability by initiating a denial of service (DoS) attack against the SSH port. A successful exploit could allow the attacker to cause the SSH service to be unresponsive during the period of the DoS attack. All other operations remain stable during the attack.
CVE-2026-1221 is a critical vulnerability in the BROWAN COMMUNICATIONS PrismX MX100 AP controller caused by the use of hard-coded database credentials embedded in the firmware. This flaw allows unauthenticated remote attackers to log into the device's database without any user interaction or privileges, potentially leading to full compromise of the device. The vulnerability has a CVSS 4.0 score of 9.3, reflecting its high impact on confidentiality, integrity, and availability. Although no known exploits are currently reported in the wild, the ease of exploitation and critical severity make it a significant threat. European organizations using PrismX MX100 controllers in their network infrastructure could face risks including data breaches, unauthorized network access, and disruption of wireless services. Mitigation requires immediate firmware updates from the vendor or, if unavailable, network segmentation and strict access controls to isolate vulnerable devices. Countries with higher adoption of BROWAN COMMUNICATIONS products and critical infrastructure relying on wireless AP controllers are at greater risk. Given the critical nature and remote unauthenticated access, this vulnerability demands urgent attention from defenders.
CVE-2025-65349 is a stored Cross-Site Scripting (XSS) vulnerability found in the web management interface of the Each Italy Wireless Mini Router WIRELESS-N 300M v28K. MiniRouter.20190211. The vulnerability arises from improper sanitization of the repeater AP SSID value, which is reflected on the /index.htm page, allowing attackers to inject and execute arbitrary scripts. Exploitation requires the attacker to have low privileges and some user interaction, but it can lead to partial compromise of confidentiality and integrity. The CVSS score is 5.4 (medium severity), indicating moderate risk. No known exploits are currently in the wild, and no patches have been published yet. European organizations using this router model should be cautious, especially in countries with higher deployment of this hardware.
In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc() TID getting from ieee80211_get_tid() might be out of range of array size of sta_entry->tids[], so check TID is less than MAX_TID_COUNT. Othwerwise, UBSAN warn: UBSAN: array-index-out-of-bounds in drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c:514:30 index 10 is out of range for type 'rtl_tid_data [9]'
This vulnerability exists in Tenda wireless routers (300Mbps Wireless Router F3 and N300 Easy Setup Router) due to the missing HTTPOnly flag for session cookies associated with the web-based administrative interface. A remote at-tacker could exploit this vulnerability by capturing session cookies transmitted over an insecure HTTP connection.
Successful exploitation of this vulnerability could allow the attacker to obtain sensitive information and gain unau-thorized access to the targeted device.
A vulnerability in the Linux kernel's mt76 wireless driver (specifically the wed callbacks for MT7996 devices) causes a kernel crash due to improper handling of wed references when using wed_hif2 devices, such as on 6GHz links. The issue leads to a kernel read from an unreadable memory address, resulting in an internal error and system instability. This vulnerability has been resolved by fixing the detection of the proper wed reference in the driver callbacks.
