EUVD-2025-16706Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Buffer over-read prevention
|
| Impact | Despite the 7.5 CVSS score, this vulnerability presents moderate-to-high real-world risk with notable caveats. The attack vector is network-based with low complexity and requires no privileges or user interaction (favorable for attackers), and the availability impact is high, supporting the CVSS rating. However, the transient nature of the DoS (temporary disruption rather than permanent compromise) and the requirement for an attacker to be within WiFi range of the target reduce practical exploitability slightly. CWE-126 (buffer over-read) typically results in information disclosure or crash-triggered DoS rather than remote code execution, limiting the severity ceiling. The lack of known KEV status or active exploitation suggests this may still be pre-disclosure or not yet widely weaponized. SSVC considerations: exploitation is likely feasible (network-accessible beacon frames are trivial to craft), automatable (no authentication needed), and causes service unavailability (high technical impact). This should be prioritized for patching on WiFi 6E/7 devices in high-availability environments (corporate networks, public WiFi, critical infrastructure), but consumer devices with intermittent connectivity may experience lower impact. |
| Exploit ScenarioDerived | An attacker positioned within WiFi range of a target network (or operating a rogue access point) crafts a malicious IEEE 802.11 beacon frame containing a specially formatted EHT Operation Information Element with an out-of-bounds payload or length field. When a vulnerable WiFi 6E/7 client or access point receives this beacon, the MAC layer driver attempts to parse the IE without proper bounds validation, triggering a buffer over-read that causes a kernel panic or driver crash. The device temporarily loses WiFi connectivity and may require a few seconds to several minutes to recover and reconnect. If the attacker continuously broadcasts the malicious beacon frame, the target device experiences repeated disconnections, rendering the network unusable for voice calls, video conferencing, or critical applications. This attack requires no authentication (beacon frames are publicly broadcast), can be executed with commodity WiFi tools (e.g., Scapy, hostapd modifications), and affects any unpatched device in range. No publicly disclosed proof-of-concept is noted in the provided data, suggesting either pre-disclosure status or limited public discussion. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 14, 2026
Transient denial-of-service vulnerability in wireless beacon frame processing that occurs when a device receives a malformed EHT (Extremely High Throughput) operation information element. An unauthenticated remote attacker can trigger a temporary service disruption by sending a specially crafted beacon frame, affecting WiFi 6E and later devices. With a CVSS score of 7.5 and high availability impact, this vulnerability requires no user interaction and is network-accessible, making it a notable threat to wireless infrastructure and client devices, though there is currently no evidence of active exploitation in the wild.
RemediationAI
Remediation requires patching at the firmware/driver level: (1) For end-user devices: update WiFi drivers and firmware to patched versions released by device manufacturers (check Dell, HP, Lenovo, Apple, Samsung, etc. for driver updates). (2) For enterprise WiFi: update access point firmware from Aruba, Cisco, Ruckus, and other vendors to versions that address the EHT operation IE parsing. (3) For Linux systems: apply kernel patches to the mac80211 or vendor-specific WiFi drivers (check with distributions for backported patches). (4) Temporary mitigation: disable WiFi 6E/7 support and operate in 802.11ax-only mode if available, though this reduces performance. (5) Network-level: update network security policies to monitor for malformed beacon frames, though this provides limited protection. Specific patch versions are not available in the provided data; vendors should publish security advisories with exact version numbers. Users should check the CVE database at NVD, vendor security pages (Broadcom, Qualcomm, Intel, etc.), and their device manufacturer's support portal for patch availability.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability exists in the WiFi beacon frame processing logic, specifically in the handling of the EHT (802.11be) Operation Information Element. CWE-126 (Buffer Over-read) indicates the root cause is likely an out-of-bounds memory read when parsing the EHT operation IE structure without proper bounds checking. The vulnerable code path is triggered during beacon frame reception and information element parsing in the MAC layer, before higher-layer validation occurs. This affects WiFi 6E (802.11ax with 6GHz) and WiFi 7 (802.11be) capable chipsets and drivers from multiple vendors including but not limited to Broadcom, Qualcomm, MediaTek, and Intel implementations that process these frames. The transient nature (non-persistent DoS) suggests the device recovers after the malformed frame is discarded, but repeated frames can cause continuous availability disruption.
Know when Ar8035 Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
Transient DOS while processing the EHT operation IE in the received beacon frame.
Executive ViewAI
CVE-2025-21463 is a denial-of-service vulnerability affecting wireless network infrastructure that processes beacon frames with specific configuration elements. Organizations relying on affected wireless equipment face potential network disruptions, as attackers can remotely trigger temporary service outages without requiring authentication or exploiting higher privileges.
Disable EHT (Extremely High Throughput) mode on affected access points if not business-critical; implement wireless intrusion detection systems (WIDS) configured to detect malformed beacon frames; restrict beacon frame processing through access control lists on network management interfaces; segment wireless networks from critical infrastructure; monitor for sudden disconnections or performance degradation indicating active exploitation; maintain firmware update readiness for rapid patching once vendor updates are released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Ar8035 Firmware
View allA Qualcomm chipset vulnerability (CVE-2026-21385) causes memory corruption through improper integer handling during memo
Memory corruption in Data Modem when a non-standard SDP body, during a VOLTE call. Rated critical severity (CVSS 9.8), t
Memory corruption while playing audio file having large-sized input buffer. Rated critical severity (CVSS 9.8), this vul
Memory corruption while redirecting log file to any file location with any file name. Rated critical severity (CVSS 9.8)
Memory corruption while processing Codec2 during v13k decoder pitch synthesis. Rated critical severity (CVSS 9.8), this
Memory corruption in WLAN Host while processing RRM beacon on the AP. Rated critical severity (CVSS 9.8), this vulnerabi
Memory corruption while sending an Assoc Request having BTM Query or BTM Response containing MBO IE. Rated critical seve
Memory corruption in WLAN Firmware while parsing a NAN management frame carrying a S3 attribute. Rated critical severity
Memory Corruption in Multi-mode Call Processor while processing bit mask API. Rated critical severity (CVSS 9.8), this v
Memory corruption in WLAN Firmware while doing a memory copy of pmk cache. Rated critical severity (CVSS 9.8), this vuln
Memory corruption in Modem while processing security related configuration before AS Security Exchange. Rated critical s
Memory Corruption in Data Modem while making a MO call or MT VOLTE call. Rated critical severity (CVSS 9.8), this vulner
GitHub PoC
Exploit-DB