WPS PIN Offline Brute-Force Exploit in Askey AP5100W Devices

CVE-2020-15023

What is CVE-2020-15023?

Askey AP5100W devices running AP5100W_Dual_SIG_1.01.097 are exposed to a vulnerability that allows attackers to execute offline brute-force attacks on the Wi-Fi Protected Setup (WPS) PIN. This weakness stems from inadequate random number generation during the Diffie-Hellman exchange, enabling the capture of WPS authentication attempts. By leveraging this captured information, an attacker can quickly derive the WPS PIN, and potentially the Wi-Fi Pre-Shared Key (PSK), granting them unauthorized access to the targeted Wi-Fi network.

References