var-201211-0048
Vulnerability from variot
Belkin wireless routers Surf N150 Model F7D1301v1, N900 Model F9K1104v1, N450 Model F9K1105V2, and N300 Model F7D2301v1 generate a predictable default WPA2-PSK passphrase based on eight digits of the WAN MAC address, which allows remote attackers to access the network by sniffing the beacon frames. Belkin offers a variety of wireless router devices. The Belkin wireless routing device prints the network name (ESSID) and the seemingly random password on the bottom of the device. Although the manufacturer's default WPA2-PSK password is more secure than the user setting, the Belkin default password is calculated only for the device. Multiple Belkin Wireless Routers are prone to a security vulnerability that may allow attackers to generate a default WPA2 password. Successfully exploiting this issue may allow attackers to generate the default WPA2 passwords. This may lead to other attacks. The following products are affected: Belkin Surf N150 F7D1301v1 Belkin N900 F9K1104v1 Belkin N450 F9K1105V2. Background
Belkin ships many wireless routers with an encrypted wireless network configured by default.
II. Description of vulnerability
Having a preconfigured randomly generated WPA2-PSK passphrase for wireless routers is basically a good idea since a vendor-generated passphrase can be much more secure than most user-generated passwords.
Each of the eight characters of the default passphrase are created by substituting a corresponding hex-digit of the wan mac address using a static substitution table.
Moreover, the default WPA2-PSK passphrase solely consists of 8 hexadecimal digits, which means that the entropy is limited to only 32 bits (or 33 bits since some models use uppercase hex digits). After sniffing one successful association of a client to the wireless network, an attacker can carry out an offline brute-force attack to crack the password. The program oclhashcat-plus can try 131,000 passwords per second on one high end GPU (AMD Radeon hd7970) [1]. Doing a full search of the 32-bit key space takes about 9 hours at this rate.
III. Impact
An attacker can exploit this vulnerability to calculate the WPA2-PSK passphrase of a wireless network. This allows sniffing and decrypting all wireless traffic in a purely passive attack given that the attacker has also sniffed the association.
The attacker may also connect to the wireless network, which may allow further exploitation of unprotected systems in the local network. An attacker may furthermore use the wireless network to access the internet from the owner's network. The network owner may then be held responsible for any illegal activities perpetrated by the unauthorized users.
IV. Affected devices
Belkin Surf N150 Model F7D1301v1
The official Belkin support page [2] contains pictures of the label of several other WiFi devices, which show that the following devices are vulnerable as well:
Belkin N900 Model F9K1104v1 Belkin N450 Model F9K1105V2
The following device uses a variation of the algorithm and the password consists of uppercase hex digits. When using our algorithm with the wlan mac of the device, the first 5 digits of the password are calculated correctly. It is likely that the algorithm differs only in the tables used.
Belkin N300 Model F7D2301v1
It is likely that other Belkin devices are affected as well. Unfortunately, Belkin has not yet cooperated with us to fix the vulnerability and/or confirm a list of other affected devices.
V. Solution
Users of potentially affected wireless routers should change the wireless passphrase to something more secure.
VI. Timeline
6.1.2012: Vendor contacted 27.1.2012: Escalated 29.10.2012: Another contact attempt, still no response 19.11.2012: Public disclosure
VII. Credits
Jakob Lell J\xf6rg Schneider
VIII. References
Advisory location: http://www.jakoblell.com/blog/?p=15
CVE-2012-4366: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4366
[1] http://hashcat.net/oclhashcat-plus/ [2] http://en-us-support.belkin.com/app/answers/detail/a_id/6989
Show details on source website{
"affected_products": {
"_id": null,
"data": [
{
"_id": null,
"model": "n450 wireless router",
"scope": "eq",
"trust": 2.4,
"vendor": "belkin",
"version": "f9k1105v2"
},
{
"_id": null,
"model": "n150 wireless router",
"scope": "eq",
"trust": 1.6,
"vendor": "belkin",
"version": "f7d1301v1"
},
{
"_id": null,
"model": "n900 wireless router",
"scope": "eq",
"trust": 1.6,
"vendor": "belkin",
"version": "f9k1104v1"
},
{
"_id": null,
"model": "n300 wireless router",
"scope": "eq",
"trust": 1.6,
"vendor": "belkin",
"version": "f7d2301v1"
},
{
"_id": null,
"model": "advance n900 dual-band wireless router",
"scope": "eq",
"trust": 0.8,
"vendor": "belkin",
"version": "f9k1104v1"
},
{
"_id": null,
"model": "n150 wireless home network router",
"scope": "eq",
"trust": 0.8,
"vendor": "belkin",
"version": "f7d1301v1"
},
{
"_id": null,
"model": "n300 wi-fi n router",
"scope": "eq",
"trust": 0.8,
"vendor": "belkin",
"version": "f7d2301v1"
},
{
"_id": null,
"model": "surf n150 model f7d1301v1",
"scope": null,
"trust": 0.6,
"vendor": "belkin",
"version": null
},
{
"_id": null,
"model": "n900 model f9k1104v1",
"scope": null,
"trust": 0.6,
"vendor": "belkin",
"version": null
},
{
"_id": null,
"model": "n450 model f9k1105v2",
"scope": null,
"trust": 0.6,
"vendor": "belkin",
"version": null
},
{
"_id": null,
"model": "n300 model f7d2301v1",
"scope": null,
"trust": 0.6,
"vendor": "belkin",
"version": null
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2012-6597"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-005440"
},
{
"db": "CNNVD",
"id": "CNNVD-201211-353"
},
{
"db": "NVD",
"id": "CVE-2012-4366"
}
]
},
"configurations": {
"_id": null,
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/h:belkin:n900",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:belkin:n150_wireless_router",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:belkin:n300",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:belkin:n450_wireless_router",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2012-005440"
}
]
},
"credits": {
"_id": null,
"data": "Jakob Lell and J\u00f6rg Schneider",
"sources": [
{
"db": "BID",
"id": "56591"
}
],
"trust": 0.3
},
"cve": "CVE-2012-4366",
"cvss": {
"_id": null,
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 6.5,
"id": "CVE-2012-4366",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "LOW",
"trust": 1.1,
"vectorString": "AV:A/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Adjacent Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 5.8,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2012-4366",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:A/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 6.5,
"id": "VHN-57647",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "LOW",
"trust": 0.1,
"vectorString": "AV:A/AC:L/AU:N/C:P/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2012-4366",
"trust": 1.0,
"value": "LOW"
},
{
"author": "NVD",
"id": "CVE-2012-4366",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNNVD",
"id": "CNNVD-201211-353",
"trust": 0.6,
"value": "LOW"
},
{
"author": "VULHUB",
"id": "VHN-57647",
"trust": 0.1,
"value": "LOW"
},
{
"author": "VULMON",
"id": "CVE-2012-4366",
"trust": 0.1,
"value": "LOW"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-57647"
},
{
"db": "VULMON",
"id": "CVE-2012-4366"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-005440"
},
{
"db": "CNNVD",
"id": "CNNVD-201211-353"
},
{
"db": "NVD",
"id": "CVE-2012-4366"
}
]
},
"description": {
"_id": null,
"data": "Belkin wireless routers Surf N150 Model F7D1301v1, N900 Model F9K1104v1, N450 Model F9K1105V2, and N300 Model F7D2301v1 generate a predictable default WPA2-PSK passphrase based on eight digits of the WAN MAC address, which allows remote attackers to access the network by sniffing the beacon frames. Belkin offers a variety of wireless router devices. The Belkin wireless routing device prints the network name (ESSID) and the seemingly random password on the bottom of the device. Although the manufacturer\u0027s default WPA2-PSK password is more secure than the user setting, the Belkin default password is calculated only for the device. Multiple Belkin Wireless Routers are prone to a security vulnerability that may allow attackers to generate a default WPA2 password. \nSuccessfully exploiting this issue may allow attackers to generate the default WPA2 passwords. This may lead to other attacks. \nThe following products are affected:\nBelkin Surf N150 F7D1301v1\nBelkin N900 F9K1104v1\nBelkin N450 F9K1105V2. Background\n\nBelkin ships many wireless routers with an encrypted wireless network \nconfigured by default. \n\nII. Description of vulnerability\n\nHaving a preconfigured randomly generated WPA2-PSK passphrase for \nwireless routers is basically a good idea since a vendor-generated \npassphrase can be much more secure than most user-generated passwords. \n\nEach of the eight characters of the default passphrase are created by \nsubstituting a corresponding hex-digit of the wan mac address using a \nstatic substitution table. \n\nMoreover, the default WPA2-PSK passphrase solely consists of 8 \nhexadecimal digits, which means that the entropy is limited to only 32 \nbits (or 33 bits since some models use uppercase hex digits). After \nsniffing one successful association of a client to the wireless network, \nan attacker can carry out an offline brute-force attack to crack the \npassword. The program oclhashcat-plus can try 131,000 passwords per \nsecond on one high end GPU (AMD Radeon hd7970) [1]. Doing a full search \nof the 32-bit key space takes about 9 hours at this rate. \n\nIII. Impact\n\nAn attacker can exploit this vulnerability to calculate the WPA2-PSK \npassphrase of a wireless network. This allows sniffing and decrypting \nall wireless traffic in a purely passive attack given that the attacker \nhas also sniffed the association. \n\nThe attacker may also connect to the wireless network, which may allow \nfurther exploitation of unprotected systems in the local network. An \nattacker may furthermore use the wireless network to access the internet \nfrom the owner\u0027s network. The network owner may then be held responsible \nfor any illegal activities perpetrated by the unauthorized users. \n\n\nIV. Affected devices\n\nBelkin Surf N150 Model F7D1301v1\n\nThe official Belkin support page [2] contains pictures of the label of \nseveral other WiFi devices, which show that the following devices are \nvulnerable as well:\n\nBelkin N900 Model F9K1104v1\nBelkin N450 Model F9K1105V2\n\nThe following device uses a variation of the algorithm and the password \nconsists of uppercase hex digits. When using our algorithm with the wlan \nmac of the device, the first 5 digits of the password are calculated \ncorrectly. It is likely that the algorithm differs only in the tables used. \n\nBelkin N300 Model F7D2301v1\n\nIt is likely that other Belkin devices are affected as well. \nUnfortunately, Belkin has not yet cooperated with us to fix the \nvulnerability and/or confirm a list of other affected devices. \n\nV. Solution\n\nUsers of potentially affected wireless routers should change the \nwireless passphrase to something more secure. \n\nVI. Timeline\n\n6.1.2012: Vendor contacted\n27.1.2012: Escalated\n29.10.2012: Another contact attempt, still no response\n19.11.2012: Public disclosure\n\nVII. Credits\n\nJakob Lell\nJ\\xf6rg Schneider\n\nVIII. References\n\nAdvisory location: http://www.jakoblell.com/blog/?p=15\n\nCVE-2012-4366: \nhttp://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4366\n\n[1] http://hashcat.net/oclhashcat-plus/\n[2] http://en-us-support.belkin.com/app/answers/detail/a_id/6989\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2012-4366"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-005440"
},
{
"db": "CNVD",
"id": "CNVD-2012-6597"
},
{
"db": "BID",
"id": "56591"
},
{
"db": "VULHUB",
"id": "VHN-57647"
},
{
"db": "VULMON",
"id": "CVE-2012-4366"
},
{
"db": "PACKETSTORM",
"id": "118208"
}
],
"trust": 2.7
},
"exploit_availability": {
"_id": null,
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-57647",
"trust": 0.1,
"type": "unknown"
},
{
"reference": "https://vulmon.com/exploitdetails?qidtp=exploitdb\u0026qid=38164",
"trust": 0.1,
"type": "exploit"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-57647"
},
{
"db": "VULMON",
"id": "CVE-2012-4366"
}
]
},
"external_ids": {
"_id": null,
"data": [
{
"db": "NVD",
"id": "CVE-2012-4366",
"trust": 3.6
},
{
"db": "BID",
"id": "56591",
"trust": 1.5
},
{
"db": "JVNDB",
"id": "JVNDB-2012-005440",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201211-353",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2012-6597",
"trust": 0.6
},
{
"db": "BUGTRAQ",
"id": "20121119 CVE-2012-4366: INSECURE DEFAULT WPA2 PASSPHRASE IN MULTIPLE BELKIN WIRELESS ROUTERS",
"trust": 0.6
},
{
"db": "PACKETSTORM",
"id": "118208",
"trust": 0.2
},
{
"db": "EXPLOIT-DB",
"id": "38164",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-57647",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2012-4366",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2012-6597"
},
{
"db": "VULHUB",
"id": "VHN-57647"
},
{
"db": "VULMON",
"id": "CVE-2012-4366"
},
{
"db": "BID",
"id": "56591"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-005440"
},
{
"db": "PACKETSTORM",
"id": "118208"
},
{
"db": "CNNVD",
"id": "CNNVD-201211-353"
},
{
"db": "NVD",
"id": "CVE-2012-4366"
}
]
},
"id": "VAR-201211-0048",
"iot": {
"_id": null,
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2012-6597"
},
{
"db": "VULHUB",
"id": "VHN-57647"
}
],
"trust": 1.5777777833333333
},
"iot_taxonomy": {
"_id": null,
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2012-6597"
}
]
},
"last_update_date": "2024-11-23T22:13:54.734000Z",
"patch": {
"_id": null,
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.belkin.com/"
},
{
"title": "",
"trust": 0.1,
"url": "https://github.com/nameisnithin/nithin "
},
{
"title": "PSKracker",
"trust": 0.1,
"url": "https://github.com/bitwisebill/PSKracker "
},
{
"title": "",
"trust": 0.1,
"url": "https://github.com/yadau/wireless-network-security-assessment "
},
{
"title": "",
"trust": 0.1,
"url": "https://github.com/madhankumar9182/wireless-network-security "
},
{
"title": "PSKracker",
"trust": 0.1,
"url": "https://github.com/soxrok2212/PSKracker "
},
{
"title": "Crippled",
"trust": 0.1,
"url": "https://github.com/Konsole512/Crippled "
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2012-4366"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-005440"
}
]
},
"problemtype_data": {
"_id": null,
"data": [
{
"problemtype": "CWE-310",
"trust": 1.1
},
{
"problemtype": "CWE-255",
"trust": 0.8
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-57647"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-005440"
},
{
"db": "NVD",
"id": "CVE-2012-4366"
}
]
},
"references": {
"_id": null,
"data": [
{
"trust": 1.8,
"url": "http://archives.neohapsis.com/archives/bugtraq/2012-11/0070.html"
},
{
"trust": 1.8,
"url": "http://www.jakoblell.com/blog/2012/11/19/cve-2012-4366-insecure-default-wpa2-passphrase-in-multiple-belkin-wireless-routers/"
},
{
"trust": 1.3,
"url": "http://www.securityfocus.com/bid/56591"
},
{
"trust": 1.2,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/80157"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-4366"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2012-4366"
},
{
"trust": 0.6,
"url": "http://seclists.org/bugtraq/2012/nov/69"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/310.html"
},
{
"trust": 0.1,
"url": "https://github.com/nameisnithin/nithin"
},
{
"trust": 0.1,
"url": "https://github.com/bitwisebill/pskracker"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://www.exploit-db.com/exploits/38164/"
},
{
"trust": 0.1,
"url": "http://hashcat.net/oclhashcat-plus/"
},
{
"trust": 0.1,
"url": "http://www.jakoblell.com/blog/?p=15"
},
{
"trust": 0.1,
"url": "http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-4366"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-4366"
},
{
"trust": 0.1,
"url": "http://en-us-support.belkin.com/app/answers/detail/a_id/6989"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2012-6597"
},
{
"db": "VULHUB",
"id": "VHN-57647"
},
{
"db": "VULMON",
"id": "CVE-2012-4366"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-005440"
},
{
"db": "PACKETSTORM",
"id": "118208"
},
{
"db": "CNNVD",
"id": "CNNVD-201211-353"
},
{
"db": "NVD",
"id": "CVE-2012-4366"
}
]
},
"sources": {
"_id": null,
"data": [
{
"db": "CNVD",
"id": "CNVD-2012-6597",
"ident": null
},
{
"db": "VULHUB",
"id": "VHN-57647",
"ident": null
},
{
"db": "VULMON",
"id": "CVE-2012-4366",
"ident": null
},
{
"db": "BID",
"id": "56591",
"ident": null
},
{
"db": "JVNDB",
"id": "JVNDB-2012-005440",
"ident": null
},
{
"db": "PACKETSTORM",
"id": "118208",
"ident": null
},
{
"db": "CNNVD",
"id": "CNNVD-201211-353",
"ident": null
},
{
"db": "NVD",
"id": "CVE-2012-4366",
"ident": null
}
]
},
"sources_release_date": {
"_id": null,
"data": [
{
"date": "2012-11-21T00:00:00",
"db": "CNVD",
"id": "CNVD-2012-6597",
"ident": null
},
{
"date": "2012-11-20T00:00:00",
"db": "VULHUB",
"id": "VHN-57647",
"ident": null
},
{
"date": "2012-11-20T00:00:00",
"db": "VULMON",
"id": "CVE-2012-4366",
"ident": null
},
{
"date": "2012-11-19T00:00:00",
"db": "BID",
"id": "56591",
"ident": null
},
{
"date": "2012-11-21T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2012-005440",
"ident": null
},
{
"date": "2012-11-19T21:56:52",
"db": "PACKETSTORM",
"id": "118208",
"ident": null
},
{
"date": "2012-11-20T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201211-353",
"ident": null
},
{
"date": "2012-11-20T00:55:01.010000",
"db": "NVD",
"id": "CVE-2012-4366",
"ident": null
}
]
},
"sources_update_date": {
"_id": null,
"data": [
{
"date": "2012-11-21T00:00:00",
"db": "CNVD",
"id": "CNVD-2012-6597",
"ident": null
},
{
"date": "2017-08-29T00:00:00",
"db": "VULHUB",
"id": "VHN-57647",
"ident": null
},
{
"date": "2017-08-29T00:00:00",
"db": "VULMON",
"id": "CVE-2012-4366",
"ident": null
},
{
"date": "2012-11-19T00:00:00",
"db": "BID",
"id": "56591",
"ident": null
},
{
"date": "2012-11-21T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2012-005440",
"ident": null
},
{
"date": "2012-11-20T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201211-353",
"ident": null
},
{
"date": "2024-11-21T01:42:45.723000",
"db": "NVD",
"id": "CVE-2012-4366",
"ident": null
}
]
},
"threat_type": {
"_id": null,
"data": "specific network environment",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201211-353"
}
],
"trust": 0.6
},
"title": {
"_id": null,
"data": "plural Belkin Wireless Router Network access vulnerabilities in products",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2012-005440"
}
],
"trust": 0.8
},
"type": {
"_id": null,
"data": "encryption problem",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201211-353"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.