CVE-2025-20046 Overview
CVE-2025-20046 is a use-after-free vulnerability [CWE-416] affecting Intel PROSet/Wireless WiFi Software for Windows before version 23.100. The flaw allows an unauthenticated attacker on an adjacent network to trigger a denial of service condition on affected systems. Exploitation requires no user interaction and no privileges, but the attacker must be within wireless radio range of the target.
The vulnerability impacts a broad range of Intel Wi-Fi 6, Wi-Fi 6E, and Wi-Fi 7 adapters commonly deployed in laptops and workstations. Intel published advisory INTEL-SA-01270 to address the issue.
Critical Impact
An adjacent attacker can trigger memory corruption in the Intel wireless driver, causing system instability or denial of service without authentication or user interaction.
Affected Products
- Intel PROSet/Wireless WiFi Software for Windows before version 23.100
- Intel Wi-Fi 6 adapters: AX101, AX200, AX201, AX203
- Intel Wi-Fi 6E (AX210, AX211) and Wi-Fi 7 (BE200, BE201, BE202) adapters
Discovery Timeline
- 2025-05-13 - CVE-2025-20046 published to NVD
- 2025-09-10 - Last updated in NVD database
Technical Details for CVE-2025-20046
Vulnerability Analysis
The vulnerability is a use-after-free condition [CWE-416] within the Intel PROSet/Wireless WiFi Software stack on Windows. A use-after-free occurs when code references memory after it has been freed, allowing an attacker to influence program execution by controlling the contents of the dangling memory region.
In this case, the flaw resides in driver-level code that processes wireless frames or management operations. Because the wireless stack runs with elevated kernel privileges, memory corruption results in driver instability and a denial of service on the host. The advisory does not indicate a path to code execution, but integrity and availability of the wireless subsystem and host are affected.
Root Cause
The root cause is improper lifetime management of a memory object inside the Intel wireless driver. Specific technical details about the affected function or object are not disclosed in the Intel advisory. Refer to the Intel Security Advisory SA-01270 for vendor-supplied details.
Attack Vector
Exploitation requires adjacent network access, meaning the attacker must be within wireless transmission range of the target device. The attacker crafts malicious wireless frames that trigger the vulnerable code path in the Intel driver. No authentication, association to a network, or user interaction is required. Successful exploitation causes the wireless stack to dereference freed memory, leading to a crash or denial of service.
No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2025-20046
Indicators of Compromise
- Unexpected crashes or bug checks referencing Intel wireless drivers such as Netwtw*.sys in Windows minidumps
- Repeated wireless adapter resets, disconnections, or driver restart events in the Windows System event log
- Loss of wireless connectivity correlating with the presence of unknown wireless transmitters nearby
Detection Strategies
- Inventory endpoints running Intel PROSet/Wireless WiFi Software and flag any installation below version 23.100
- Correlate Windows kernel crash events (BugCheck ID 1001) with Intel wireless driver modules across the fleet
- Monitor wireless management frame anomalies in environments with wireless intrusion detection capabilities
Monitoring Recommendations
- Forward Windows Event Log channels System and Application to a centralized log platform for crash correlation
- Alert on driver version drift where Intel wireless driver versions remain on vulnerable releases after patch deployment
- Track adapter reset frequency per host and investigate outliers that exceed baseline
How to Mitigate CVE-2025-20046
Immediate Actions Required
- Update Intel PROSet/Wireless WiFi Software to version 23.100 or later on all affected Windows endpoints
- Identify hosts containing Intel Wi-Fi 6, 6E, and 7 adapters listed in the advisory and prioritize them for patching
- Validate driver version post-deployment using endpoint management tooling
Patch Information
Intel released fixed software in version 23.100 of Intel PROSet/Wireless WiFi Software for Windows. Download the update from the OEM or directly from Intel. Full details are available in the Intel Security Advisory SA-01270.
Workarounds
- Disable the wireless adapter on systems that cannot be patched immediately and rely on wired connectivity
- Operate affected devices only in trusted RF environments where adjacent attackers are unlikely to be present
- Enforce driver update policies through Windows Update for Business or enterprise patch management tooling
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
