CVE-2017-13087 Wi-Fi Protected Access (WPA and WPA2) that support 802.11v allows reinstallation of the Group Temporal Key (GTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame, allowing...

MediumCVSS 5.3 EPSS 1.7%

Published: 2017-10-17 16:00
Updated: 2026-09-01 23:03
Exploit status: No public exploit known

Description

Wi-Fi Protected Access (WPA and WPA2) that support 802.11v allows reinstallation of the Group Temporal Key (GTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame, allowing an attacker within radio range to replay frames from access points to clients.

Affected products

Product	Affected versions	Fixed in
debian/wpa(Debian:12)	< 2:2.4-1.1	2:2.4-1.1
debian/wpa(Debian:13)	< 2:2.4-1.1	2:2.4-1.1
debian/wpa(Debian:14)	< 2:2.4-1.1	2:2.4-1.1
Canonical Ubuntu Linux	= 14.04	No fix listed
Canonical Ubuntu Linux	= 16.04	No fix listed
Canonical Ubuntu Linux	= 17.04	No fix listed
debian linux	= 8.0	No fix listed
debian linux	= 9.0	No fix listed
freebsd	All versions	No fix listed
freebsd	= 10	No fix listed
freebsd	= 10.4	No fix listed
freebsd	= 11	No fix listed
freebsd	= 11.1	No fix listed
openSUSE leap	= 42.2	No fix listed
openSUSE leap	= 42.3	No fix listed
redhat enterprise linux desktop	= 7	No fix listed
redhat enterprise linux server	= 7	No fix listed
w1.fi hostapd	= 0.2.4	No fix listed
w1.fi hostapd	= 0.2.5	No fix listed
w1.fi hostapd	= 0.2.6	No fix listed
w1.fi hostapd	= 0.2.8	No fix listed
w1.fi hostapd	= 0.3.7	No fix listed
w1.fi hostapd	= 0.3.9	No fix listed
w1.fi hostapd	= 0.3.10	No fix listed
w1.fi hostapd	= 0.3.11	No fix listed

Show 103 more

Product	Affected versions	Fixed in
w1.fi hostapd	= 0.4.7	No fix listed
w1.fi hostapd	= 0.4.8	No fix listed
w1.fi hostapd	= 0.4.9	No fix listed
w1.fi hostapd	= 0.4.10	No fix listed
w1.fi hostapd	= 0.4.11	No fix listed
w1.fi hostapd	= 0.5.7	No fix listed
w1.fi hostapd	= 0.5.8	No fix listed
w1.fi hostapd	= 0.5.9	No fix listed
w1.fi hostapd	= 0.5.10	No fix listed
w1.fi hostapd	= 0.5.11	No fix listed
w1.fi hostapd	= 0.6.8	No fix listed
w1.fi hostapd	= 0.6.9	No fix listed
w1.fi hostapd	= 0.6.10	No fix listed
w1.fi hostapd	= 0.7.3	No fix listed
w1.fi hostapd	= 1.0	No fix listed
w1.fi hostapd	= 1.1	No fix listed
w1.fi hostapd	= 2.0	No fix listed
w1.fi hostapd	= 2.1	No fix listed
w1.fi hostapd	= 2.2	No fix listed
w1.fi hostapd	= 2.3	No fix listed
w1.fi hostapd	= 2.4	No fix listed
w1.fi hostapd	= 2.5	No fix listed
w1.fi hostapd	= 2.6	No fix listed
w1.fi wpa supplicant	= 0.2.4	No fix listed
w1.fi wpa supplicant	= 0.2.5	No fix listed
w1.fi wpa supplicant	= 0.2.6	No fix listed
w1.fi wpa supplicant	= 0.2.7	No fix listed
w1.fi wpa supplicant	= 0.2.8	No fix listed
w1.fi wpa supplicant	= 0.3.7	No fix listed
w1.fi wpa supplicant	= 0.3.8	No fix listed
w1.fi wpa supplicant	= 0.3.9	No fix listed
w1.fi wpa supplicant	= 0.3.10	No fix listed
w1.fi wpa supplicant	= 0.3.11	No fix listed
w1.fi wpa supplicant	= 0.4.7	No fix listed
w1.fi wpa supplicant	= 0.4.8	No fix listed
w1.fi wpa supplicant	= 0.4.9	No fix listed
w1.fi wpa supplicant	= 0.4.10	No fix listed
w1.fi wpa supplicant	= 0.4.11	No fix listed
w1.fi wpa supplicant	= 0.5.7	No fix listed
w1.fi wpa supplicant	= 0.5.8	No fix listed
w1.fi wpa supplicant	= 0.5.9	No fix listed
w1.fi wpa supplicant	= 0.5.10	No fix listed
w1.fi wpa supplicant	= 0.5.11	No fix listed
w1.fi wpa supplicant	= 0.6.8	No fix listed
w1.fi wpa supplicant	= 0.6.9	No fix listed
w1.fi wpa supplicant	= 0.6.10	No fix listed
w1.fi wpa supplicant	= 0.7.3	No fix listed
w1.fi wpa supplicant	= 1.0	No fix listed
w1.fi wpa supplicant	= 1.1	No fix listed
w1.fi wpa supplicant	= 2.0	No fix listed
w1.fi wpa supplicant	= 2.1	No fix listed
w1.fi wpa supplicant	= 2.2	No fix listed
w1.fi wpa supplicant	= 2.3	No fix listed
w1.fi wpa supplicant	= 2.4	No fix listed
w1.fi wpa supplicant	= 2.5	No fix listed
w1.fi wpa supplicant	= 2.6	No fix listed
SUSE linux enterprise desktop	= 12-sp2	No fix listed
SUSE linux enterprise desktop	= 12-sp3	No fix listed
SUSE linux enterprise point of sale	= 11-sp3	No fix listed
SUSE linux enterprise server	= 11-sp3	No fix listed
SUSE linux enterprise server	= 11-sp4	No fix listed
SUSE linux enterprise server	= 12	No fix listed
SUSE openstack cloud	= 6	No fix listed
alpine/hostapd(Alpine:v3.10)	< 2.6-r2	2.6-r2
alpine/hostapd(Alpine:v3.11)	< 2.6-r2	2.6-r2
alpine/hostapd(Alpine:v3.12)	< 2.6-r2	2.6-r2
alpine/hostapd(Alpine:v3.13)	< 2.6-r2	2.6-r2
alpine/hostapd(Alpine:v3.14)	< 2.6-r2	2.6-r2
alpine/hostapd(Alpine:v3.15)	< 2.6-r2	2.6-r2
alpine/hostapd(Alpine:v3.16)	< 2.6-r2	2.6-r2
alpine/hostapd(Alpine:v3.17)	< 2.6-r2	2.6-r2
alpine/hostapd(Alpine:v3.18)	< 2.6-r2	2.6-r2
alpine/hostapd(Alpine:v3.19)	< 2.6-r2	2.6-r2
alpine/hostapd(Alpine:v3.20)	< 2.6-r2	2.6-r2
alpine/hostapd(Alpine:v3.21)	< 2.6-r2	2.6-r2
alpine/hostapd(Alpine:v3.22)	< 2.6-r2	2.6-r2
alpine/hostapd(Alpine:v3.23)	< 2.6-r2	2.6-r2
alpine/hostapd(Alpine:v3.24)	< 2.6-r2	2.6-r2
alpine/hostapd(Alpine:v3.5)	< 2.6-r1	2.6-r1
alpine/hostapd(Alpine:v3.6)	< 2.6-r2	2.6-r2
alpine/hostapd(Alpine:v3.7)	< 2.6-r2	2.6-r2
alpine/hostapd(Alpine:v3.8)	< 2.6-r2	2.6-r2
alpine/hostapd(Alpine:v3.9)	< 2.6-r2	2.6-r2
alpine/wpa_supplicant(Alpine:v3.10)	< 2.6-r7	2.6-r7
alpine/wpa_supplicant(Alpine:v3.11)	< 2.6-r7	2.6-r7
alpine/wpa_supplicant(Alpine:v3.12)	< 2.6-r7	2.6-r7
alpine/wpa_supplicant(Alpine:v3.13)	< 2.6-r7	2.6-r7
alpine/wpa_supplicant(Alpine:v3.14)	< 2.6-r7	2.6-r7
alpine/wpa_supplicant(Alpine:v3.15)	< 2.6-r7	2.6-r7
alpine/wpa_supplicant(Alpine:v3.16)	< 2.6-r7	2.6-r7
alpine/wpa_supplicant(Alpine:v3.17)	< 2.6-r7	2.6-r7
alpine/wpa_supplicant(Alpine:v3.18)	< 2.6-r7	2.6-r7
alpine/wpa_supplicant(Alpine:v3.19)	< 2.6-r7	2.6-r7
alpine/wpa_supplicant(Alpine:v3.20)	< 2.6-r7	2.6-r7
alpine/wpa_supplicant(Alpine:v3.21)	< 2.6-r7	2.6-r7
alpine/wpa_supplicant(Alpine:v3.22)	< 2.6-r7	2.6-r7
alpine/wpa_supplicant(Alpine:v3.23)	< 2.6-r7	2.6-r7
alpine/wpa_supplicant(Alpine:v3.24)	< 2.6-r7	2.6-r7
alpine/wpa_supplicant(Alpine:v3.5)	< 2.6-r2	2.6-r2
alpine/wpa_supplicant(Alpine:v3.6)	< 2.6-r4	2.6-r4
alpine/wpa_supplicant(Alpine:v3.7)	< 2.6-r7	2.6-r7
alpine/wpa_supplicant(Alpine:v3.8)	< 2.6-r7	2.6-r7
alpine/wpa_supplicant(Alpine:v3.9)	< 2.6-r7	2.6-r7

References

Debian Security Tracker CVE-2017-13087 vendor-advisory
SUSE-SU-2017:2745 third-party-advisory vendor-advisory
SUSE-SU-2017:2752 third-party-advisory vendor-advisory
openSUSE-SU-2017:2755 third-party-advisory vendor-advisory
www.arubanetworks.com third-party-advisory
DSA-3999 third-party-advisory vendor-advisory
VU#228519 third-party-advisory us-government-resource
101274 third-party-advisory vdb-entry
1039573 third-party-advisory vdb-entry
1039576 third-party-advisory vdb-entry
1039577 third-party-advisory vdb-entry
1039578 third-party-advisory vdb-entry
1039581 third-party-advisory vdb-entry
USN-3455-1 third-party-advisory vendor-advisory
RHSA-2017:2907 third-party-advisory vendor-advisory
RHSA-2017:2911 third-party-advisory vendor-advisory
access.redhat.com third-party-advisory
cert-portal.siemens.com
cert.vde.com
FreeBSD-SA-17:07 third-party-advisory vendor-advisory
GLSA-201711-03 vendor-advisory
source.android.com
support.lenovo.com third-party-advisory
20171016 Multiple Vulnerabilities in Wi-Fi Protected Access and Wi-Fi Protected Access II third-party-advisory vendor-advisory
w1.fi third-party-advisory
www.krackattacks.com technical-description third-party-advisory
security.alpinelinux.org vendor-advisory

CVSS v3.0

5.3 Medium

CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector: Adjacent
Attack Complexity: High
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: High
Availability: None

All scores (4)

v3.0 5.3 · nvd@nist.gov
v3.0 5.3 · osv:debian
v3.0 5.3 · osv:alpine
v2.0 2.9 · nvd@nist.gov

Weakness & likelihood

EPSS (exploitation probability, 30 days): 1.74% (percentile 78.1)
CWE: CWE-330

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.