It was reported [1] that the default permissions of /etc/hostapd/hostapd.conf were insecure (0644) considering they could contain credentials (PSKs, shared radius secrets, etc.) that would then be world readable.

This is a low-impact flaw that be mitigated by changing the permissions to the file (upstream has done this now).

This was assigned CVE-2012-2389 [2] (although no credentials are written by any tools or by default to this file, so an administrator should logically tighten up the permissions if saving sensitive information to the file).

[1] https://bugzilla.novell.com/show_bug.cgi?id=740964
[2] http://www.openwall.com/lists/oss-security/2012/05/23/13