CVE-2024-53941.txt

An issue was discovered in Victure RX1800 WiFi 6 Router (software EN_V1.0.0_r12_110933, hardware 1.0) devices. 
A remote attacker (in proximity to a Wi-Fi network) can derive the default Wi-Fi PSK value via the last 4 octets of the BSSID.
> ------------------------------------------
> [Vulnerability Type]
> Incorrect Access Control
>
> ------------------------------------------
>
> [Vendor of Product]
> Victure
>
> ------------------------------------------
>
> [Affected Product Code Base]
> Victure RX1800 WiFi 6 Router - Software Version: EN_V1.0.0_r12_110933
>
> ------------------------------------------
>
> [Affected Component]
> Default PSK, weak password based on last 4 octets of BSSID
>
> ------------------------------------------
>
> [Attack Type]
> Remote
>
> ------------------------------------------
>
> [Impact Denial of Service]
> true
>
> ------------------------------------------
>
> [Impact Escalation of Privileges]
> true
>
> ------------------------------------------
>
> [Impact Information Disclosure]
> true
>
> ------------------------------------------
>
> [Attack Vectors]
> Weak Default Pre-Shared Key (PSK): The default PSK for Wi-Fi networks is generated based on the last 4 octets of the BSSID (in lowercase)
>
> ------------------------------------------
>
> [Reference]
> https://www.newegg.com/p/2W6-002R-00004
> https://github.com/actuator/cve/tree/main/Victure
>
> ------------------------------------------
>
> [Discoverer]
> Edward Warren