A computing standard than enables users to easily stand up an encrypted wireless network suffers from a design weakness that could enable attackers to gain router access, according to US-CERT.
The vulnerability exists in the WiFi Protected Setup (WPS) and could allow an adversary to brute force the standard's authentication method, drastically reducing the number of attempts necessary to retrieve the router's PIN password. With this in hand, the adversary can change the access point's configuration and launch a denial-of-service attack.
"When the PIN authentication fails, the access point will send [a message] back to the client," according to a US-CERT advisory. "The...messages are sent in a way that an attacker is able to determine if the first half of the PIN is correct. Also, the last digit of the PIN is known because it is a checksum for the PIN."
The attack is aided if wireless routers lack any lock-out capabilities when PINs are repeatedly attempted.
As users await updated firmware, disabling WPS is the only known fix for the vulnerability, which was discovered by researcher Stefan Viehbock. In a research note, he recommended vendors "introduce sufficiently long lock-down periods in order to make an attack impractical."
