CVE-2014-9690 Weak cryptography in WS318 V100R001C01B022 and earlier versions
Weak randomness in WPS PIN generation allows offline brute force attacks, enabling unauthorized internet access via the gateway.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2014-9690?
CVE-2014-9690 is a high-severity vulnerability in WS318 V100R001C01B022 and earlier versions, published on 2 Apr 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Huawei home gateways WS318 with software V100R001C01B022 and earlier versions are affected by the PIN offline brute force cracking vulnerability of the WPS protocol because the random number generator (RNG) used in the supplier's solution is not random enough. As a result, brute force cracking the PIN code is easier. After an attacker cracks the PIN, the attacker can access the Internet via the cracked device.
Weakness: CWE-332
Which versions are affected by CVE-2014-9690?
It affects 1 product.
Products include Huawei Ws318 Firmware.
How do I fix CVE-2014-9690?
No fix has been published for CVE-2014-9690 yet. Limit exposure of the affected software until one is available.
Is CVE-2014-9690 being exploited?
There is no known exploitation of CVE-2014-9690 in the wild and no public exploit code.
Sources
Also known as GHSA-44xr-76mv-jx32.