Inadequate Encryption Strength in Cisco Systems, Inc products - CVE-2019-15126

Vulnerability identifier: #VU25646

CSH Severity: Low

CVSS v4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-15126

CWE-ID: CWE-326

Exploitation vector: Adjecent network

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to decrypt Wi-Fi frames.

The vulnerability exists because after an affected device handles a disassociation event it can send a limited number of Wi-Fi frames encrypted with a static, weak Pairwise Temporal Key (PTK). A remote attacker on the local network can acquire these frames and decrypt them with the static PTK without the knowledge of the security session establishment used to secure the Wi-Fi network.

Cisco Connected Grid Routers
Cisco RV340W Dual WAN Gigabit Wireless-AC VPN Router
Cisco WAP125 Wireless-AC Dual Band Desktop Access Point with PoE
Cisco WAP150 Wireless-AC/N Dual Radio Access Point with PoE
Cisco WAP361 Wireless-AC/N Dual Radio Wall Plate Access Point with PoE
Cisco WAP571 Wireless-AC/N Premium Dual Radio Access Point with PoE
Cisco WAP571E Wireless-AC/N Premium Dual Radio Outdoor Access Point
Cisco WAP581 Wireless-AC Dual Radio Wave 2 Access Point
Cisco Catalyst 9115 Series Wi-Fi 6 Access Points
Cisco Catalyst 9120 Series Access Points
RV110W Wireless-N VPN Firewall
RV215W Wireless-N VPN Router
Cisco Small Business RV130 Series VPN Routers
Cisco Wireless IP Phone 8821
HoloLens
SIMATIC RF350M
SIMOTICS CONNECT 400
SIMATIC RF650M
SUSE MicroOS
SUSE Linux Enterprise Server
SUSE Linux Enterprise Module for Basesystem
bcm43xx-firmware
kernel-firmware
ucode-amd

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

bcm43xx-firmware - update to 20180314-4.6.1
kernel-firmware - addressed in versions 20190618-5.17.1, 20200107-3.23.1
ucode-amd - addressed in versions 20190618-5.17.1, 20200107-3.23.1

• Exploit #6470 - Kr00k (Resources for the Kr00k vulnerability (CVE-2019-15126)) (June 25, 2021)
• Exploit #5740 - Broadcom Wi-Fi Devices - 'KR00K Information Disclosure (June 17, 2021)
• Exploit #2081 - r00kie-kr00kie (PoC exploit for the CVE-2019-15126 kr00k vulnerability) (March 18, 2020)

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200226-wi-fi-info-disclosure

• Information disclosure in Cisco Wi-Fi Protected Network and Wi-Fi Protected Network 2
• Information disclosure in Siemens SIMATIC and SIMOTICS
• SUSE update for bcm43xx-firmware
• SUSE update for kernel-firmware
• SUSE update for kernel-firmware
• Information disclosure in Microsoft HoloLens 1 devices