PT-2019-13040 · Autopi · Autopi Wi-Fi/Nb+1

Published 2019-10-14 · Updated 2020-08-24 · CVE-2019-12941

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AutoPi Wi-Fi/NB and 4G/LTE devices before 2019-10-15

Description The issue allows an attacker to perform a brute-force attack or dictionary attack to gain access to the WiFi network, providing root access to the device. This is possible because the default WiFi password and WiFi SSID are derived from the same hash function output, with the input being only 8 characters. As a result, an attacker can deduce the WiFi password from the WiFi SSID.

Recommendations For AutoPi Wi-Fi/NB and 4G/LTE devices before 2019-10-15, consider changing the default WiFi password to a stronger, unique password to prevent brute-force or dictionary attacks. Additionally, update the device to a version released after 2019-10-15, if available. As a temporary workaround, restrict access to the WiFi network to minimize the risk of exploitation.

Exploit

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2019-12941

Affected Products

Autopi 4G/Lte

Autopi Wi-Fi/Nb

References · 6

• 🔥 http://diva-portal.org/smash/get/diva2:1334244/FULLTEXT01.pdf · Exploit
• 🔥 https://kth.se/polopoly_fs/1.931922.1571071632!/Burdzovic_Matsson_dongle_v2.pdf · Exploit
• https://osv.dev/vulnerability/CVE-2019-12941 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-12941 · Security Note
• https://kth.se/polopoly_fs/1.931922.1571071632%21/Burdzovic_Matsson_dongle_v2.pdf · Note
• https://kth.se/nse/research/software-systems-architecture-and-security · Note