Published:2016/05/12  Last Updated:2016/05/12

JVN#25674893
WN-GDN/R3 Series does not limit authentication attempts

Overview

WN-GDN/R3 Series provided by I-O DATA DEVICE, INC. does not limit authentication attempts.

Products Affected

  • WN-GDN/R3
  • WN-GDN/R3-S
  • WN-GDN/R3-U
  • WN-GDN/R3-C

Description

WN-GDN/R3 series provided by I-O DATA DEVICE, INC. is a wireless LAN router. WPS functionality in WN-GDN/R3 Series does not limit PIN authentication attempts, making it susceptible to brute force attacks.

Impact

An unauthenticated attacker within wireless range of the device may perform a brute force attack to recover the PIN. Using the recovered PIN, the attacker may gain access to the network.

Solution

Apply a Workaround
The following workaround will mitigate this vulnerability.

  • Disable the WPS functionality

Vendor Status

Vendor Status Last Update Vendor Notes
I-O DATA DEVICE, INC. Vulnerable 2016/05/12 I-O DATA DEVICE, INC. website

References

  1. CERT/CC Vulnerability Note VU#723755
    WiFi Protected Setup (WPS) PIN brute force vulnerability

JPCERT/CC Addendum

Vulnerability Analysis by JPCERT/CC

CVSS v3 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Base Score: 4.3
Attack Vector(AV) Physical (P) Local (L) Adjacent (A) Network (N)
Attack Complexity(AC) High (H) Low (L)
Privileges Required(PR) High (H) Low (L) None (N)
User Interaction(UI) Required (R) None (N)
Scope(S) Unchanged (U) Changed (C)
Confidentiality Impact(C) None (N) Low (L) High (H)
Integrity Impact(I) None (N) Low (L) High (H)
Availability Impact(A) None (N) Low (L) High (H)
CVSS v2 AV:A/AC:L/Au:N/C:P/I:N/A:N
Base Score: 3.3
Access Vector(AV) Local (L) Adjacent Network (A) Network (N)
Access Complexity(AC) High (H) Medium (M) Low (L)
Authentication(Au) Multiple (M) Single (S) None (N)
Confidentiality Impact(C) None (N) Partial (P) Complete (C)
Integrity Impact(I) None (N) Partial (P) Complete (C)
Availability Impact(A) None (N) Partial (P) Complete (C)

Credit

Takeshi Okamoto of Kanagawa Institute of Technology and Takaaki Minegishi reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

Other Information

JPCERT Alert
JPCERT Reports
CERT Advisory
CPNI Advisory
TRnotes
CVE CVE-2016-1206
JVN iPedia JVNDB-2016-000061