CVE-2018-0412

Vulnerability

The vulnerability resides in the Extensible Authentication Protocol over LAN (EAPOL) implementation of Cisco Small Business 100 Series and 300 Series Wireless Access Points. It stems from improper processing of certain EAPOL messages during the Wi-Fi handshake (4-way handshake). An attacker can manipulate the exchange to force the use of the weaker WPA-TKIP cipher instead of the more secure AES-CCMP cipher. All firmware versions prior to the fix are affected; details of specific releases are available via Cisco Bug ID CSCvj29229 [1].

Exploitation

An attacker must be in an adjacent network position (within radio range) and establish a man-in-the-middle (MITM) position between a supplicant (Wi-Fi client) and the authenticator (access point). No authentication or prior access to the network is required. The attacker then intercepts and modifies EAPOL messages during the 4-way handshake to negotiate the weaker WPA-TKIP cipher [1]. The victim must be connecting or reconnecting to the access point for the attack to succeed.

Impact

Successful exploitation forces the encryption algorithm downgrade to WPA-TKIP. This weakens the security of the wireless session and allows the attacker to conduct subsequent cryptographic attacks, such as dictionary or brute-force attacks on the TKIP key, potentially leading to the disclosure of confidential information transmitted over the Wi-Fi connection [1].

Mitigation

Cisco has released fixed software versions for affected products. For specific fixed release information, refer to Cisco Bug ID CSCvj29229 and the Cisco Security Advisory [1]. No workarounds are available. Users should upgrade to the latest firmware provided by Cisco for their respective access point model [1].