CVE-2019-12587: Espressif Esp-Idf

High severity, CVSS 8.1. EPSS: 0.9% chance of exploitation in the next 30 days.

The EAP peer implementation in Espressif ESP-IDF 2.0.0 through 4.0.0 and ESP8266_NONOS_SDK 2.2.0 through 3.1.0 allows the installation of a zero Pairwise Master Key (PMK) after the completion of any EAP authentication method, which allows attackers in radio range to replay, decrypt, or spoof frames via a rogue access point.

Affected products

• Espressif Esp-Idf: from 2.0.0, up to and including 4.0.0
• Espressif ESP8266 Nonos SDK: from 2.2.0, up to and including 3.1.0

Published 2019-09-04. Last modified 2026-06-17.