CVE-2019-12941

Vulnerability

The vulnerability affects AutoPi Wi-Fi/NB and 4G/LTE devices prior to 2019-10-15, as reported by researchers at KTH [1]. The default WiFi password and SSID are both derived from the same hash function whose input is only 8 characters. This weak derivation allows an attacker to deduce the WiFi password from the WiFi SSID. The device provides root access once connected to the WiFi network.

Exploitation

An attacker can perform a brute-force or dictionary attack against the WiFi network. Because the password is derived from a short 8-character input, the keyspace is limited. The attacker can obtain the WiFi SSID (which is broadcast) and then compute possible passwords offline or online. No authentication or prior access is required; the attacker only needs to be within wireless range of the device.

Impact

Successful exploitation grants the attacker access to the WiFi network, which in turn provides root access to the AutoPi device. This allows full compromise of the device, including the ability to read, modify, or disrupt its operations. The impact is high as the device may be used in critical automotive or IoT applications.

Mitigation

The vendor released a fix on 2019-10-15. Users should update their devices to the latest firmware version. No workaround is available if the device cannot be updated. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog as of this writing.