CVE-2017-13082
At a glance
- Severity
- Not available
- EPSS
- EPSS 4.58 % · percentile 92 (2026-10-27)
- State
- PUBLISHED
- Published
- Updated
- Assigner
- certcc
- NVD status
- Modified
Description
Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11r allows reinstallation of the Pairwise Transient Key (PTK) Temporal Key (TK) during the fast BSS transmission (FT) handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.0 | HIGH 8.1 | CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 5.8 | AV:A/AC:L/Au:N/C:P/I:P/A:P | NVD · nvd@nist.gov (Primary) |
Weaknesses (CWE)
European references
- ENISA EUVD · EUVD-2017-4600
- GCVE · GCVE-0-2017-13082
CERT-FR advisories
- CERTFR-2022-AVI-267 — Multiples vulnérabilités dans Juniper Networks Junos Space · cert.ssi.gouv.fr
- CERTFR-2017-AVI-398 — Multiples vulnérabilités dans NVIDIA Shield Tablet · cert.ssi.gouv.fr
- CERTFR-2017-AVI-394 — Multiples vulnérabilités dans Google Android (Nexus) · cert.ssi.gouv.fr
- CERTFR-2017-AVI-361 — Multiples vulnérabilités dans les produits Juniper utilisant le protocole WPA/WPA2 · cert.ssi.gouv.fr
- CERTFR-2017-AVI-360 — Multiples vulnérabilités dans les produits Fortinet utilisant le protocole WPA/WPA2 · cert.ssi.gouv.fr
- CERTFR-2017-AVI-359 — Multiples vulnérabilités dans Ubuntu wpa_supplicant et hostpad · cert.ssi.gouv.fr
- CERTFR-2017-AVI-358 — Multiples vulnérabilités dans Debian sur le protocole WPA/WPA2 · cert.ssi.gouv.fr
- CERTFR-2017-ALE-014 — Vulnérabilité dans le protocole WPA/WPA2 · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*cpe:2.3:o:canonical:ubuntu_linux:17.04:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*cpe:2.3:o:freebsd:freebsd:10:*:*:*:*:*:*:*cpe:2.3:o:freebsd:freebsd:10.4:*:*:*:*:*:*:*cpe:2.3:o:freebsd:freebsd:11:*:*:*:*:*:*:*cpe:2.3:o:freebsd:freebsd:11.1:*:*:*:*:*:*:*cpe:2.3:o:opensuse:leap:42.2:*:*:*:*:*:*:*cpe:2.3:o:opensuse:leap:42.3:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_desktop:7:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server:7:*:*:*:*:*:*:*cpe:2.3:a:w1.fi:hostapd:0.2.4:*:*:*:*:*:*:*cpe:2.3:a:w1.fi:hostapd:0.2.5:*:*:*:*:*:*:*cpe:2.3:a:w1.fi:hostapd:0.2.6:*:*:*:*:*:*:*cpe:2.3:a:w1.fi:hostapd:0.2.8:*:*:*:*:*:*:*cpe:2.3:a:w1.fi:hostapd:0.3.7:*:*:*:*:*:*:*cpe:2.3:a:w1.fi:hostapd:0.3.9:*:*:*:*:*:*:*cpe:2.3:a:w1.fi:hostapd:0.3.10:*:*:*:*:*:*:*cpe:2.3:a:w1.fi:hostapd:0.3.11:*:*:*:*:*:*:*cpe:2.3:a:w1.fi:hostapd:0.4.7:*:*:*:*:*:*:*cpe:2.3:a:w1.fi:hostapd:0.4.8:*:*:*:*:*:*:*cpe:2.3:a:w1.fi:hostapd:0.4.9:*:*:*:*:*:*:*cpe:2.3:a:w1.fi:hostapd:0.4.10:*:*:*:*:*:*:*cpe:2.3:a:w1.fi:hostapd:0.4.11:*:*:*:*:*:*:*cpe:2.3:a:w1.fi:hostapd:0.5.7:*:*:*:*:*:*:*cpe:2.3:a:w1.fi:hostapd:0.5.8:*:*:*:*:*:*:*cpe:2.3:a:w1.fi:hostapd:0.5.9:*:*:*:*:*:*:*cpe:2.3:a:w1.fi:hostapd:0.5.10:*:*:*:*:*:*:*cpe:2.3:a:w1.fi:hostapd:0.5.11:*:*:*:*:*:*:*cpe:2.3:a:w1.fi:hostapd:0.6.8:*:*:*:*:*:*:*cpe:2.3:a:w1.fi:hostapd:0.6.9:*:*:*:*:*:*:*cpe:2.3:a:w1.fi:hostapd:0.6.10:*:*:*:*:*:*:*cpe:2.3:a:w1.fi:hostapd:0.7.3:*:*:*:*:*:*:*cpe:2.3:a:w1.fi:hostapd:1.0:*:*:*:*:*:*:*cpe:2.3:a:w1.fi:hostapd:1.1:*:*:*:*:*:*:*cpe:2.3:a:w1.fi:hostapd:2.0:*:*:*:*:*:*:*cpe:2.3:a:w1.fi:hostapd:2.1:*:*:*:*:*:*:*- +45 more
Affected products
| Product | Versions |
|---|---|
| Wi-Fi Alliance · Wi-Fi Protected Access (WPA and WPA2) | affected WPA ; affected WPA2 |
References
- http://www.securitytracker.com/id/1039581
- http://www.securityfocus.com/bid/101274
- https://rockwellautomation.custhelp.com/app/answers/detail/a_id/1066697
- http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
- http://www.debian.org/security/2017/dsa-3999
- https://access.redhat.com/security/vulnerabilities/kracks
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171016-wpa
- https://w1.fi/security/2017-1/wpa-packet-number-reuse-with-replayed-messages.txt
- http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-007.txt
- http://www.securitytracker.com/id/1039571
- https://ics-cert.us-cert.gov/advisories/ICSA-17-299-02
- https://source.android.com/security/bulletin/2017-11-01
- https://security.gentoo.org/glsa/201711-03
- https://access.redhat.com/errata/RHSA-2017:2907
- http://www.securitytracker.com/id/1039570
- https://support.lenovo.com/us/en/product_security/LEN-17420
- https://security.FreeBSD.org/advisories/FreeBSD-SA-17:07.wpa.asc
- https://www.krackattacks.com/
- http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
- http://www.securitytracker.com/id/1039573
- http://www.kb.cert.org/vuls/id/228519
- https://cert-portal.siemens.com/productcert/pdf/ssa-901333.pdf
- https://github.com/vanhoefm/krackattacks-test-ap-ft
- https://cert.vde.com/en-us/advisories/vde-2017-005
- http://www.ubuntu.com/usn/USN-3455-1
- http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00021.html
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |