Information disclosure in Microsoft HoloLens 1 devices



Risk Low
Patch available NO
Number of vulnerabilities 1
CVE-ID CVE-2019-15126
CWE-ID CWE-326
Exploitation vector Local network
Public exploit Public exploit code for vulnerability #1 is available.
Vulnerable software
 HoloLens
Hardware solutions / Office equipment, IP-phones, print servers

Vendor Microsoft

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) Inadequate Encryption Strength

EUVDB-ID: #VU25646

Risk: Low

CVSSv4.0: 5.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2019-15126

CWE-ID: CWE-326 - Inadequate Encryption Strength

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to decrypt Wi-Fi frames.

The vulnerability exists because after an affected device handles a disassociation event it can send a limited number of Wi-Fi frames encrypted with a static, weak Pairwise Temporal Key (PTK). A remote attacker on the local network can acquire these frames and decrypt them with the static PTK without the knowledge of the security session establishment used to secure the Wi-Fi network.

Mitigation

Broadcom no longer supports their hardware on any Windows platforms. As such there is no security update available to address this vulnerability. We recommend that customers using HoloLens 1 devices with this WiFi client device do the following to protect themselves from this vulnerability:

  • Update Wi-Fi routers to mitigate security vulnerabilities (for example, FragAttacks).
  • Use WPA2-Enterprise with certificate-based authentication for HoloLens Wi-Fi.
  • Don’t connect your HoloLens device to untrusted Wi-Fi networks.
  • Don’t reuse Wi-Fi passwords.
  • Don't use plain text HTTP connection.
  • Enable Kiosk mode on your HoloLens device and prevent users from using apps that expose URL links.

Vulnerable software versions

HoloLens: All versions

CPE2.3 External links

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-15126


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.



###SIDEBAR###