CVE-2022-37660 Other in n/a
An attacker can subvert future PKEX associations by reusing encryption elements from past sessions, bypassing security controls in hostapd.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-37660?
CVE-2022-37660 is a medium-severity vulnerability in n/a, published on 11 Feb 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In hostapd 2.10 and earlier, the PKEX code remains active even after a successful PKEX association. An attacker that successfully bootstrapped public keys with another entity using PKEX in the past, will be able to subvert a future bootstrapping by passively observing public keys, re-using the encrypting element Qi and subtracting it from the captured message M (X = M - Qi). This will result in the public ephemeral key X; the only element required to subvert the PKEX association.
Weakness: CWE-323
Which versions are affected by CVE-2022-37660?
It affects 1 product.
Products include W1.fi Hostapd.
How do I fix CVE-2022-37660?
Apply the vendor's patch.
Is CVE-2022-37660 being exploited?
There is no known exploitation of CVE-2022-37660 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as CLSA-2026-1781274016, DEBIAN-CVE-2022-37660, GHSA-hmq6-3hm7-3h78, UBUNTU-CVE-2022-37660.