KrØØk :: CVE‑2019‑15126 :: Industry‑wide vulnerability affected encryption of billion+ Wi‑Fi devices
11 May, 2020
ESET researchers recently reported that an industry-wide vulnerability named KrØØk could potentially affect devices with Broadcom Wi-Fi chips. D-Link is currently investigating the issue with Broadcom to understand the potential impact on D-Link devices. Meanwhile, we strongly advise D-Link device owners use encrypted connection methods such as HTTPS, SSH, or POP3S to minimise their risk of being hacked. We will provide updates as soon as we have more information.
An issue was discovered on Broadcom Wi-Fi client devices. Specifically timed and handcrafted traffic can cause internal errors (related to state transitions) in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure over the air for a discrete set of traffic, a different vulnerability than CVE-2019-9500, CVE-2019-9501, CVE-2019-9502, and CVE-2019-9503.
D-Link takes the issues of network security and user privacy very seriously. We have a dedicated task force and product management team on call to address evolving security issues and implement appropriate security measures. Please check the D-Link website for updates regularly.
The vulnerability affects both WPA2-Personal and WPA2-Enterprise protocols, with AES-CCMP encryption.
- CVE: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15126
|Model||Hardware Revision||Affected FW||Fixed FW||Recommendation||Last Updated|
|DIR-868L||All Ax Hardware Revisions||v1.20b01 & Below||v1.21b01_Beta||Please Download and Upgrade||04/28/2020|
|DIR-880L||All Ax Hardware Revisions||v1.08b04 & Below||v1.21b01||Please Download and Upgrade||12/06/2020|
|FIR-890L||All Ax Hardware Revisions||v1.20b01 & Below||v1.22b01||Please Download and Upgrade||12/06/2020|
|DWL-2600AP||All Ax Hardware Revisions||v184.108.40.206 & Below||v220.127.116.11B002C||Please Download and Upgrade||04/16/2020|
|DWL-3600AP||All Ax Hardware Revisions||v18.104.22.168 & Below||v22.214.171.124B003C||Please Download and Upgrade||04/16/2020|
|DWL-3610AP||All Ax Hardware Revisions||v126.96.36.199 & Below||v188.8.131.52_Hotfix||Please Download and Upgrade||04/28/2020|
|DWL-6600AP||All Ax Hardware Revisions||v184.108.40.206 & Below||v220.127.116.11B003C||Please Download and Upgrade||
|DWL-6610AP||All Ax Hardware Revisions||v18.104.22.168 & Below||v22.214.171.124B003C||Please Download and Upgrade||
|DWL-6610AP||All Bx Hardware Revisions||v126.96.36.199 & Below||v188.8.131.52_Hotfix||Please Download and Upgrade||04/28/2020|
|DWL-8600AP||All Ax Hardware Revisions||v184.108.40.206 & Below||
Please Download and Upgrade
|DWL-8610AP||All Ax Hardware Revisions||v220.127.116.11 & Below||v18.104.22.168B022C||Please Download and Upgrade||04/23/2020|
|DWL-8710AP||All Ax Hardware Revisions||v22.214.171.124 & Below||v126.96.36.199b009C||Please Download and Upgrade||04/23/2020|