CVE-2014-3686

wpa_supplicant and hostapd 0.7.2 through 2.2, when running with certain configurations and using wpa_cli or hostapd_cli with action scripts, allows remote attackers to execute arbitrary commands via a crafted frame.

Published: Oct 16, 2014
Updated: Nov 9, 2025
CVE: CVE-2014-3686
Severity: Medium
Exploit:

CVSS v2:

Severity: Medium
Score: 6.8
AV:N/AC:M/Au:N/C:P/I:P/A:P

CWEs:

CWE-20

Affected Software
References

Software	From	Fixed in
w1.fi / hostapd	1.1	1.1.x
w1.fi / hostapd	2.0	2.0.x
w1.fi / wpa_supplicant	2.1	2.1.x
w1.fi / wpa_supplicant	2.2	2.2.x
w1.fi / hostapd	1.0	1.0.x
w1.fi / wpa_supplicant	1.0	1.0.x
w1.fi / wpa_supplicant	1.1	1.1.x
debian / debian_linux	6.0	6.0.x
w1.fi / hostapd	0.7.2	0.7.2.x
canonical / ubuntu_linux	14.04	14.04.x
canonical / ubuntu_linux	12.04	12.04.x
w1.fi / wpa_supplicant	0.72	0.72.x
w1.fi / hostapd	2.2	2.2.x
canonical / ubuntu_linux	10.04	10.04.x
w1.fi / hostapd	2.1	2.1.x
w1.fi / wpa_supplicant	2.0	2.0.x

http://advisories.mageia.org/MGASA-2014-0429.html
http://lists.opensuse.org/opensuse-security-announce/2014-11/msg00000.html
http://lists.opensuse.org/opensuse-updates/2014-10/msg00027.html
http://lists.opensuse.org/opensuse-updates/2014-10/msg00028.html
http://rhn.redhat.com/errata/RHSA-2014-1956.html
http://secunia.com/advisories/60366
http://secunia.com/advisories/60428
http://secunia.com/advisories/61271
http://w1.fi/security/2014-1/
http://www.debian.org/security/2014/dsa-3052
http://www.mandriva.com/security/advisories?name=MDVSA-2015:120
http://www.openwall.com/lists/oss-security/2014/10/09/28
http://www.securityfocus.com/bid/70396
http://www.ubuntu.com/usn/USN-2383-1
https://bugzilla.redhat.com/show_bug.cgi?id=1151259
https://security.gentoo.org/glsa/201606-17

Vulnerability Database

300,445

CVE-2014-3686

Deep Security Visibility Without the Complexity