PT-2024-5576 · Unknown+4 · Wpa Supplicant+4

Marc Deslauriers + 3 · Published 2024-05-30 · Updated 2025-11-18 · CVE-2024-5290

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions wpa supplicant (affected versions not specified)

Description The issue is related to an uncontrolled search path element in wpa supplicant, allowing a local unprivileged attacker to escalate privileges to the user that wpa supplicant runs as, usually root. Membership in the netdev group or access to the dbus interface of wpa supplicant allows an unprivileged user to specify an arbitrary path to a module to be loaded by the wpa supplicant process. The estimated number of potentially affected devices is in the millions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

BDU:2024-06261

CVE-2024-5290

DSA-5739-1

OESA-2024-2142

USN-6945-1

Affected Products

Astra Linux

Linuxmint

Red Os

Ubuntu

Wpa Supplicant

References · 34

• 🔥 https://bugs.launchpad.net/ubuntu/+source/wpa/+bug/2067613 · Exploit
• 🔥 https://snyk.io/blog/abusing-ubuntu-root-privilege-escalation · Exploit
• https://osv.dev/vulnerability/OESA-2024-2142 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2025-0114SE18MD · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-5290 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2024-5290 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-5290 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2024-5290 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-5290 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-5290 · Security Note
• https://ubuntu.com/security/CVE-2024-5290 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2025-0422SE47 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6945-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20251225SE16 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-5290 · Vendor Advisory