EUVD-2025-16706CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
3Tags
Description
Transient DOS while processing the EHT operation IE in the received beacon frame.
Analysis
Transient denial-of-service vulnerability in wireless beacon frame processing that occurs when a device receives a malformed EHT (Extremely High Throughput) operation information element. An unauthenticated remote attacker can trigger a temporary service disruption by sending a specially crafted beacon frame, affecting WiFi 6E and later devices. With a CVSS score of 7.5 and high availability impact, this vulnerability requires no user interaction and is network-accessible, making it a notable threat to wireless infrastructure and client devices, though there is currently no evidence of active exploitation in the wild.
Technical Context
This vulnerability exists in the WiFi beacon frame processing logic, specifically in the handling of the EHT (802.11be) Operation Information Element. CWE-126 (Buffer Over-read) indicates the root cause is likely an out-of-bounds memory read when parsing the EHT operation IE structure without proper bounds checking. The vulnerable code path is triggered during beacon frame reception and information element parsing in the MAC layer, before higher-layer validation occurs. This affects WiFi 6E (802.11ax with 6GHz) and WiFi 7 (802.11be) capable chipsets and drivers from multiple vendors including but not limited to Broadcom, Qualcomm, MediaTek, and Intel implementations that process these frames. The transient nature (non-persistent DoS) suggests the device recovers after the malformed frame is discarded, but repeated frames can cause continuous availability disruption.
Affected Products
Affected products include all WiFi 6E (802.11ax) and WiFi 7 (802.11be) capable devices with vulnerable beacon frame processing implementations. Likely affected vendors and product categories: Broadcom BCM43684, BCM4375, BCM4389 chipsets; Qualcomm FastConnect 6900, 7150 series; MediaTek Filogic chipsets; Intel WiFi 6E AX411, BE200 series; and any end-user devices (laptops, tablets, smartphones, IoT devices, access points, routers) using these chipsets. Specific affected CPE patterns would include: cpe:2.3:h:broadcom:bcm43684:*:*:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* (for WiFi driver implementations), and vendor-specific firmware versions. Without vendor-specific advisories in the provided data, exact version ranges cannot be specified, but all firmware releases prior to the patched version for each vendor are affected.
Remediation
Remediation requires patching at the firmware/driver level: (1) For end-user devices: update WiFi drivers and firmware to patched versions released by device manufacturers (check Dell, HP, Lenovo, Apple, Samsung, etc. for driver updates). (2) For enterprise WiFi: update access point firmware from Aruba, Cisco, Ruckus, and other vendors to versions that address the EHT operation IE parsing. (3) For Linux systems: apply kernel patches to the mac80211 or vendor-specific WiFi drivers (check with distributions for backported patches). (4) Temporary mitigation: disable WiFi 6E/7 support and operate in 802.11ax-only mode if available, though this reduces performance. (5) Network-level: update network security policies to monitor for malformed beacon frames, though this provides limited protection. Specific patch versions are not available in the provided data; vendors should publish security advisories with exact version numbers. Users should check the CVE database at NVD, vendor security pages (Broadcom, Qualcomm, Intel, etc.), and their device manufacturer's support portal for patch availability.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today