EUVD-2025-16706Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
3DescriptionCVE.org
Transient DOS while processing the EHT operation IE in the received beacon frame.
AnalysisAI
Transient denial-of-service vulnerability in wireless beacon frame processing that occurs when a device receives a malformed EHT (Extremely High Throughput) operation information element. An unauthenticated remote attacker can trigger a temporary service disruption by sending a specially crafted beacon frame, affecting WiFi 6E and later devices. With a CVSS score of 7.5 and high availability impact, this vulnerability requires no user interaction and is network-accessible, making it a notable threat to wireless infrastructure and client devices, though there is currently no evidence of active exploitation in the wild.
Technical ContextAI
This vulnerability exists in the WiFi beacon frame processing logic, specifically in the handling of the EHT (802.11be) Operation Information Element. CWE-126 (Buffer Over-read) indicates the root cause is likely an out-of-bounds memory read when parsing the EHT operation IE structure without proper bounds checking. The vulnerable code path is triggered during beacon frame reception and information element parsing in the MAC layer, before higher-layer validation occurs. This affects WiFi 6E (802.11ax with 6GHz) and WiFi 7 (802.11be) capable chipsets and drivers from multiple vendors including but not limited to Broadcom, Qualcomm, MediaTek, and Intel implementations that process these frames. The transient nature (non-persistent DoS) suggests the device recovers after the malformed frame is discarded, but repeated frames can cause continuous availability disruption.
RemediationAI
Remediation requires patching at the firmware/driver level: (1) For end-user devices: update WiFi drivers and firmware to patched versions released by device manufacturers (check Dell, HP, Lenovo, Apple, Samsung, etc. for driver updates). (2) For enterprise WiFi: update access point firmware from Aruba, Cisco, Ruckus, and other vendors to versions that address the EHT operation IE parsing. (3) For Linux systems: apply kernel patches to the mac80211 or vendor-specific WiFi drivers (check with distributions for backported patches). (4) Temporary mitigation: disable WiFi 6E/7 support and operate in 802.11ax-only mode if available, though this reduces performance. (5) Network-level: update network security policies to monitor for malformed beacon frames, though this provides limited protection. Specific patch versions are not available in the provided data; vendors should publish security advisories with exact version numbers. Users should check the CVE database at NVD, vendor security pages (Broadcom, Qualcomm, Intel, etc.), and their device manufacturer's support portal for patch availability.
More in Qcn6024 Firmware
View allA Qualcomm chipset vulnerability (CVE-2026-21385) causes memory corruption through improper integer handling during memo
Memory corruption in Data Modem when a non-standard SDP body, during a VOLTE call. Rated critical severity (CVSS 9.8), t
Memory corruption while redirecting log file to any file location with any file name. Rated critical severity (CVSS 9.8)
Memory corruption while playing audio file having large-sized input buffer. Rated critical severity (CVSS 9.8), this vul
Memory corruption while redirecting log file to any file location with any file name. Rated critical severity (CVSS 9.8)
Memory corruption while processing Codec2 during v13k decoder pitch synthesis. Rated critical severity (CVSS 9.8), this
Memory corruption in WLAN Host while processing RRM beacon on the AP. Rated critical severity (CVSS 9.8), this vulnerabi
Memory corruption while sending an Assoc Request having BTM Query or BTM Response containing MBO IE. Rated critical seve
Memory corruption in WLAN Firmware while parsing a NAN management frame carrying a S3 attribute. Rated critical severity
Memory Corruption in Multi-mode Call Processor while processing bit mask API. Rated critical severity (CVSS 9.8), this v
Memory corruption in WLAN Firmware while doing a memory copy of pmk cache. Rated critical severity (CVSS 9.8), this vuln
Memory corruption in Modem while processing security related configuration before AS Security Exchange. Rated critical s
Same weakness CWE-126 – Buffer Over-read
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today