CVE-2025-27558

CRITICAL EPSS 18.7%

Published May 21, 20251y ago · Modified Jun 17, 20262w ago

9.1 CVSS 3.1

Critical

Published May 21, 2025 1y ago

Last Modified Jun 17, 2026 2w ago

Description

IEEE P802.11-REVme D1.1 through D7.0 allows FragAttacks against mesh networks. In mesh networks using Wi-Fi Protected Access (WPA, WPA2, or WPA3) or Wired Equivalent Privacy (WEP), an adversary can exploit this vulnerability to inject arbitrary frames towards devices that support receiving non-SSP A-MSDU frames. NOTE: this issue exists because of an incorrect fix for CVE-2020-24588. P802.11-REVme, as of early 2025, is a planned release of the 802.11 standard.

CVSS Details

Base Score

9.1

Exploitability

3.9

Impact

5.2

Vector string

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction None

Scope Unchanged

Confidentiality High

Integrity High

Availability None

Threat Intelligence

EPSS Exploit Probability

18.7% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-345

References 2

github.com https://github.com/vanhoefm/fragattacks-survey-public/blob/main/README.md
lists.debian.org https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.