PT-2020-14125 · Askey · Ap5100W

Published

2020-12-11

·

Updated

2022-08-06

·

CVE-2020-15023

CVSS v3.1

5.9

Medium

VectorAV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions Askey AP5100W devices through AP5100W Dual SIG 1.01.097
Description The issue arises from problems with the random number selection for the Diffie-Hellman exchange, allowing an attacker to brute force the overall authentication exchange by capturing an attempted WPS authentication attempt. This enables the attacker to obtain the recovered WPS PIN in minutes or even seconds and eventually gain access to the Wi-Fi network by obtaining the Wi-Fi PSK key.
Recommendations For Askey AP5100W devices through AP5100W Dual SIG 1.01.097, consider disabling WPS authentication until a patch is available to prevent brute-force cracking of the WPS PIN. Restrict access to the Wi-Fi network to minimize the risk of exploitation. Avoid using WPS for authentication until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use of Insufficiently Random Values

Weakness Enumeration

CWE-330

Related Identifiers

CVE-2020-15023

Affected Products

Ap5100W