CVE-2015-4145: The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 does not validate...

Security readout for executives and security teams

This is a denial-of-service issue in the EAP-pwd authentication code in hostapd and wpa_supplicant 1.0 through 2.4. A crafted remote message can trigger a memory leak, potentially degrading or stopping wireless authentication. The provided sources do not describe data theft or code execution. Likely exposure is wireless infrastructure, embedded devices, or clients running hostapd or wpa_supplicant 1.0 through 2.4 where EAP-pwd is configured. Systems not using EAP-pwd are less likely to be affected based on the supplied description. Treat as a targeted availability risk for affected wireless authentication services. Prioritize patching where EAP-pwd is enabled in production or guest-accessible environments. This should not outrank confirmed exploited remote code execution issues unless authentication availability is business critical. Mitigation focus: Inventory hostapd and wpa_supplicant versions on wireless and embedded systems.; Apply vendor security updates from Debian, Ubuntu, Gentoo, openSUSE, or your platform vendor.; Disable EAP-pwd where it is not required for business operation..

Prepared

Jun 13, 2026, 22:39 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.