CVE-2020-15023

Askey AP5100W devices through AP5100W_Dual_SIG_1.01.097 are affected by WPS PIN offline brute-force cracking

published December 11, 2020

CVSS
—
EPSS
2%
Percentile
76.0
In the wild
Unconfirmed
What it is

Askey AP5100W devices through AP5100W_Dual_SIG_1.01.097 are affected by WPS PIN offline brute-force cracking. This arises because of issues with the random number selection for the Diffie-Hellman exchange. By capturing an attempted (and even failed) WPS authentication attempt, it is possible to brute force the overall authentication exchange. This allows an attacker to obtain the recovered WPS PIN in minutes or even seconds, and eventually obtain the Wi-Fi PSK key, gaining access to the Wi=Fi network.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01630 · 76.0th percentile
Published
2020-12-11T15:23Z
EPSS history
Timeline
  • 11 DEC 15:23Z
    Askey AP5100W devices through AP5100W_Dual_SIG_1.01.097 are affected by WPS PIN offline brute-force cracking
    cvelistv5