SSL Wireless SMS Notification for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.8.1. The public final_login_ajax_action handler resolves a user and issues an authenticated session by matching the wp_sslcare_otp table on only the attacker-supplied phone and cap_data, without verifying the SMS OTP or any server-side single-use state. Because cap_data was chosen by the attacker in the public otp_login_ajax_action step (which stores the row before sending the SMS), the finalize step trivially matches and the user is looked up solely by the sslcare_login_phone meta. This makes it possible for unauthenticated attackers who know a phone-linked user's number to take over that account.
This vulnerability involves the p54 wireless driver firmware record length validation in Microsoft software version 3.0. The provided information is limited and does not describe the nature or impact of the vulnerability in detail.
This vulnerability involves the mt76 wireless driver component, specifically the mt7915 device, where the receive NAPI (New API) is not properly disabled when the device is removed. The issue is identified in Microsoft products with versions 3.0 and 4.0 affected. No CVSS score or detailed impact information is provided.
A vulnerability in the Linux kernel's mac80211 wireless subsystem was fixed by validating the length of deauthentication frames before accessing the reason code. The function ieee80211_rx_mgmt_deauth() previously read the deauthentication reason code without first confirming that the frame contained the required fixed field, potentially leading to improper memory access.
CVE-2026-114383 is a critical stack-based buffer overflow vulnerability in TOTOLINK EX200 firmware version 5.2.3c.7200. It exists in the setWiFiAclAddConfig function within the wireless.so component, accessible via the /cgi-bin/cstecgi.cgi endpoint. The flaw can be exploited remotely without authentication by manipulating the macAddress parameter. Public exploit code is available, increasing the risk of exploitation.
This vulnerability concerns a use-after-free (UAF) flaw in the brcmsmac wireless driver function brcms_free_timer(). It affects Microsoft products with versions 3.0 and 4.0. No CVSS score or detailed impact information is provided, and there is no indication of known exploitation in the wild.
A vulnerability in the Linux kernel's mac80211 wireless subsystem allows oversized IEEE 802.11 fragments to cause an integer overflow in the fragment payload length accumulator. This overflow leads to insufficient buffer allocation and ultimately triggers a kernel crash in softirq context when processing fragmented frames. The issue arises because the fragment length sum is stored in a 16-bit unsigned integer, which can overflow when large fragments are received. The flaw has been fixed by adding a check to drop frames that would cause overflow without increasing memory footprint.
A vulnerability in the Linux kernel's ath9k wireless driver was resolved that involved improper handling of short WMI command responses. The function ath9k_wmi_rsp_callback() could read beyond the expected response buffer if the device response was shorter than anticipated, potentially leading to memory safety issues. The fix involves detecting short responses, recording an error, and preventing stale data consumption.
A vulnerability in the Linux kernel's mac80211 wireless subsystem was resolved. The issue involved insufficient validation of TX status rate metadata in the minstrel_ht_tx_status() function, which could lead to out-of-bounds indexing in rate tables. The fix involves validating rate metadata earlier in the TX status path to prevent malformed metadata from corrupting mac80211 state. This mitigates potential instability caused by bad driver reports without causing kernel panics.
A vulnerability in the Linux kernel's usb storage driver for Sierra Wireless devices allows a malicious USB device to cause a partial information leak. The flaw occurs because the driver accepts short USB control message transfers without verifying the full expected data length, leading to uninitialized kernel memory being exposed via a sysfs attribute. This can disclose up to 5 bytes of stale kernel heap memory to unprivileged userspace per read. The issue is resolved by rejecting short transfers and only accepting full data structures.
A memory leak vulnerability in the Linux kernel's iwlegacy driver for Intel 3945 wireless devices was resolved. The issue occurs because EEPROM data allocated during device probe is not freed upon device removal, leading to a memory leak. This was identified through manual code inspection and fixed by freeing the EEPROM data in the device removal function.
A use-after-free vulnerability in the Linux kernel's mac80211 WiFi subsystem was resolved. The issue involved improper counting of channel context reservations during replacement operations, which could lead to premature freeing of a channel context still in use. This flaw could cause instability or crashes during beacon generation in wireless networking.
A vulnerability in the Linux kernel's mac80211 wireless subsystem allowed unicast frames sent on one interface to be incorrectly transmitted to stations of a different VLAN within the same BSS. This occurred because the station lookup function matched stations across VLANs rather than restricting to the interface the frame was sent on. The issue has been resolved by ensuring only stations of the sending interface are matched, except for control port frames.
A vulnerability in the Linux kernel's mac80211 wireless subsystem allows a specially crafted Channel Switch Announcement (CSA) frame to cause a kernel panic. This occurs because the kernel improperly handles an invalid 320 MHz bandwidth indication on non-6 GHz links, leading to an uninitialized read and potential panic when panic_on_warn is enabled. The issue has been resolved by rejecting invalid channel definitions before processing.
CVE-2026-98707 is a high-severity vulnerability in the Linux kernel's mac80211 wireless subsystem. It involves improper handling of the RX Block Acknowledgement (BA) session timer during teardown, which can lead to timer callbacks running against freed memory. This occurs because the session timer remains queued on a freed tid_rx structure, allowing stale handlers to rearm the timer after deletion begins. The issue is resolved by using timer_shutdown_sync() to prevent rearming once teardown starts.
A vulnerability in the Linux kernel's mac80211 wireless subsystem involves improper handling of power-save (PS) delivery work during station teardown. The flaw allows a delayed worker to continue delivering frames after the station has been marked dead and removed, potentially causing inconsistent driver state or resource handling. The issue has been fixed by adjusting the timing of work cancellation during station cleanup.
This vulnerability in the Linux kernel's mac80211 wireless subsystem involves an unnecessary warning triggered when an IBSS (ad-hoc) network has no channel to scan due to regulatory domain changes. The warning occurs because the regulatory domain can change while the IBSS is operating, leaving no allowed channels temporarily during a 60-second grace period before shutdown. The issue has been resolved by removing this warning in such cases.