Logo
›
›vulnerability›CVE-2022-37660
Name
CVE-2022-37660
Source
NVD ( link)Debian ( link)
Description
In hostapd 2.10 and earlier, the PKEX code remains active even after a successful PKEX association. An attacker that successfully bootstrapped public keys with another entity using PKEX in the past, will be able to subvert a future bootstrapping by passively observing public keys, re-using the encrypting element Qi and subtracting it from the captured message M (X = M - Qi). This will result in the public ephemeral key X; the only element required to subvert the PKEX association.
CWEs
CWE-323
Published Date
Updated Date
Workaround
-
Advisories
https://link.springer.com/article/10.1007/s10207-025-00988-3Third Party Advisory
https://w1.fi/cgit/hostap/commit/?id=15af83cf1846870873a011ed4d714732f01cd2e4Patch

Analysis#

Affected Component
Analysis
wpa-supplicant
Patched
hostapd
Patched

Vulnerability Ratings#

6.5
CVSSv31
NaN
other

Others affected components#

Name
Project
Project Version
Version
Status
hostapd
buildroot
2025.02.x
2.11
Not Affected
wpa_supplicant
buildroot
2025.02.x
2.11
Not Affected
hostapd
buildroot
master
2.11
Not Affected
wpa_supplicant
buildroot
master
2.11
Not Affected
hostapd
openwrt
master
2026.04.02~b004de0bf1b54d669d358b7f33d6f474bd9719a6-r1
Not Affected
hs20
openwrt
master
2020.06.08~5a8b366233f5585e68a4ffbb604fbb4a848eb325-r10
Not Affected
hostapd
openwrt
openwrt-25.12
2025.08.26~ca266cc24d8705eb1a2a0857ad326e48b1408b20-r1
Not Affected
hs20
openwrt
openwrt-25.12
2020.06.08~5a8b366233f5585e68a4ffbb604fbb4a848eb325-r10
Not Affected
hostapd
yocto
master
2.11
Not Affected
wpa-supplicant
yocto
master
2.11
Not Affected
hostapd
yocto
scarthgap
2.10
Patched
wpa-supplicant
yocto
scarthgap
2.10
Patched

Resolved with patches#

hostapd (yocto:kirkstone)

#
Title
Author
Resolve
1
DPP: Delete PKEX code and identifier on success completion of
Jouni Malinen <quic_jouni@quicinc.com>
CVE-2022-37660
2
DPP3: PKEX over TCP
Jouni Malinen <jouni@qca.qualcomm.com>
CVE-2022-37660
3
DPP3: Add PKEX initiator retries and fallback from v2 to v1
Jouni Malinen <quic_jouni@quicinc.com>
CVE-2022-37660
4
DPP: Change PKEX version configuration design
Jouni Malinen <quic_jouni@quicinc.com>
CVE-2022-37660

wpa-supplicant (yocto:kirkstone)

#
Title
Author
Resolve
1
DPP: Delete PKEX code and identifier on success completion of
Jouni Malinen <quic_jouni@quicinc.com>
CVE-2022-37660
2
DPP3: PKEX over TCP
Jouni Malinen <jouni@qca.qualcomm.com>
CVE-2022-37660
3
DPP: Change PKEX version configuration design
Jouni Malinen <quic_jouni@quicinc.com>
CVE-2022-37660
4
DPP3: Add PKEX initiator retries and fallback from v2 to v1
Jouni Malinen <quic_jouni@quicinc.com>
CVE-2022-37660
5
DPP3: Start with PKEXv2 and fall back to v1
Jouni Malinen <quic_jouni@quicinc.com>
CVE-2022-37660

hostapd (yocto:scarthgap)

#
Title
Author
Resolve
1
DPP: Delete PKEX code and identifier on success completion of
Jouni Malinen <quic_jouni@quicinc.com>
CVE-2022-37660
2
DPP3: PKEX over TCP
Jouni Malinen <jouni@qca.qualcomm.com>
CVE-2022-37660
3
DPP3: Add PKEX initiator retries and fallback from v2 to v1
Jouni Malinen <quic_jouni@quicinc.com>
CVE-2022-37660
4
DPP: Change PKEX version configuration design
Jouni Malinen <quic_jouni@quicinc.com>
CVE-2022-37660

wpa-supplicant (yocto:scarthgap)

#
Title
Author
Resolve
1
DPP: Delete PKEX code and identifier on success completion of
Jouni Malinen <quic_jouni@quicinc.com>
CVE-2022-37660
2
DPP3: PKEX over TCP
Jouni Malinen <jouni@qca.qualcomm.com>
CVE-2022-37660
3
DPP: Change PKEX version configuration design
Jouni Malinen <quic_jouni@quicinc.com>
CVE-2022-37660
4
DPP3: Add PKEX initiator retries and fallback from v2 to v1
Jouni Malinen <quic_jouni@quicinc.com>
CVE-2022-37660
5
DPP3: Start with PKEXv2 and fall back to v1
Jouni Malinen <quic_jouni@quicinc.com>
CVE-2022-37660