CVE-2017-13080
Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the group key handshake, allowing an attacker within radio range to replay frames from access points to clients.
Does this matter?
Lower severity and a low EPSS score (2.28%). Track it; it rarely justifies an emergency change on its own.
Description
Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the group key handshake, allowing an attacker within radio range to replay frames from access points to clients.
- CVSS 3.0
- 5.3 MEDIUMCVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
- EPSS
- 2.28% probability · 83th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-323, CWE-330
- Affected
- canonical/ubuntu linux · debian/debian linux · freebsd/freebsd · opensuse/leap · redhat/enterprise linux desktop · redhat/enterprise linux server · w1.fi/hostapd · w1.fi/wpa supplicant · suse/linux enterprise desktop · suse/linux enterprise point of sale · suse/linux enterprise server · suse/openstack cloud
- Source
- cret@cert.org
EPSS 2.3% since 27 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
References
- http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00020.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00023.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00024.htmlThird Party Advisory
- http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-007.txtThird Party Advisory
- http://www.debian.org/security/2017/dsa-3999Third Party Advisory
- http://www.kb.cert.org/vuls/id/228519Third Party Advisory, US Government Resource
- http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
- http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
- http://www.securityfocus.com/bid/101274Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1039572Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1039573Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1039576Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1039577Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1039578Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1039581Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1039585Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1039703
- http://www.ubuntu.com/usn/USN-3455-1Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:2907Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:2911Third Party Advisory
- https://access.redhat.com/security/vulnerabilities/kracksThird Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-901333.pdf
- https://cert.vde.com/en-us/advisories/vde-2017-003
- https://cert.vde.com/en-us/advisories/vde-2017-005
- https://lists.debian.org/debian-lts-announce/2017/12/msg00004.html
- https://lists.debian.org/debian-lts-announce/2018/11/msg00015.html
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-13080Vendor Advisory
- https://security.FreeBSD.org/advisories/FreeBSD-SA-17:07.wpa.ascThird Party Advisory
- https://security.gentoo.org/glsa/201711-03
- https://source.android.com/security/bulletin/2017-11-01
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.