CVE-2020-15023

Askey AP5100W devices through AP5100W_Dual_SIG_1.01.097 are affected by WPS PIN offline brute-force cracking. This arises because of issues with the random number selection for the Diffie-Hellman exchange. By capturing an attempted (and even failed) WPS authentication attempt, it is possible to brute force the overall authentication exchange. This allows an attacker to obtain the recovered WPS PIN in minutes or even seconds, and eventually obtain the Wi-Fi PSK key, gaining access to the Wi=Fi network.

CVSS v3 5.9 MEDIUM
CVSS v2.0 4.3 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://medium.com/csg-govtech/bolstering-security-how-i-breached-a-wifi-mesh-access-point-from-close-proximity-to-uncover-f8f77dc3cd5d	Exploit Third Party Advisory
https://www.askey.com.tw/Products/wifi.html	Product Vendor Advisory
https://www.askey.com.tw/incident_report_notifications.html	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:askey:ap5100w_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:askey:ap5100w:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2020-12-11 16:15

Updated : 2024-02-28 18:08

NVD link : CVE-2020-15023

Mitre link : CVE-2020-15023

CVE.ORG link : CVE-2020-15023

JSON object : View

Products Affected

askey

ap5100w
ap5100w_firmware

CWE

CWE-330

Use of Insufficiently Random Values

{"id": "CVE-2020-15023", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.2}]}, "published": "2020-12-11T16:15:11.963", "references": [{"url": "https://medium.com/csg-govtech/bolstering-security-how-i-breached-a-wifi-mesh-access-point-from-close-proximity-to-uncover-f8f77dc3cd5d", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.askey.com.tw/Products/wifi.html", "tags": ["Product", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.askey.com.tw/incident_report_notifications.html", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-330"}]}], "descriptions": [{"lang": "en", "value": "Askey AP5100W devices through AP5100W_Dual_SIG_1.01.097 are affected by WPS PIN offline brute-force cracking. This arises because of issues with the random number selection for the Diffie-Hellman exchange. By capturing an attempted (and even failed) WPS authentication attempt, it is possible to brute force the overall authentication exchange. This allows an attacker to obtain the recovered WPS PIN in minutes or even seconds, and eventually obtain the Wi-Fi PSK key, gaining access to the Wi=Fi network."}, {"lang": "es", "value": "Los dispositivos Askey AP5100W versiones hasta AP5100W_Dual_SIG_1.01.097 est\u00e1n afectados por un descifrado de fuerza bruta fuera de l\u00ednea WPS PIN. Esto surge debido a problemas con la selecci\u00f3n de n\u00fameros aleatorios para el intercambio Diffie-Hellman. Al capturar un intento de autenticaci\u00f3n WPS intentado (e incluso fallido), es posible forzar el intercambio de autenticaci\u00f3n general por fuerza bruta. Esto permite a un atacante obtener el WPS PIN recuperado en minutos o incluso segundos y, eventualmente, obtener la clave Wi-Fi PSK, consiguiendo acceso a la red Wi=Fi"}], "lastModified": "2022-08-06T03:51:10.497", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:askey:ap5100w_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DEA479C0-DA13-4758-A040-CFCE65757D57", "versionEndIncluding": "1.01.097"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:askey:ap5100w:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A91B5C62-33BA-4377-B506-1276FED5D0F8"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}