PT-2025-22422 · Unknown+1 · Ieee P802.11-Revme+1

Published 2025-05-21 · Updated 2026-05-26 · CVE-2025-27558

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions IEEE P802.11-REVme versions D1.1 through D7.0

Description The issue allows FragAttacks against mesh networks using Wi-Fi Protected Access (WPA, WPA2, or WPA3) or Wired Equivalent Privacy (WEP). An adversary can exploit this to inject arbitrary frames towards devices that support receiving non-SSP A-MSDU frames. This problem exists because of an incorrect fix for a previous issue.

Recommendations For IEEE P802.11-REVme versions D1.1 through D7.0, consider disabling the reception of non-SSP A-MSDU frames as a temporary workaround until a patch is available. Restrict access to mesh networks using WPA, WPA2, WPA3, or WEP to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

BDU:2025-15558

CVE-2025-27558

DLA-4328-1

DSA-5973-1

DSA-5975-1

ECHO-C886-FD04-A91B

OESA-2026-2172

OESA-2026-2175

OESA-2026-2176

Affected Products

Debian

Ieee P802.11-Revme

References · 53

• https://nvd.nist.gov/vuln/detail/CVE-2026-31473 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-23475 · Security Note
• https://bdu.fstec.ru/vul/2025-15558 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-31431 · Security Note
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2025-1113SE18 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23096 · Security Note
• https://osv.dev/vulnerability/OESA-2026-2172 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-27558 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2025-27558 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23457 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-23458 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-23452 · Security Note
• https://osv.dev/vulnerability/DSA-5973-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-27558 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-27558 · Vendor Advisory