CVE-2025-46413

Executive Summary

CVE-2025-46413 exposes a critical weakness in BUFFALO WSR-1800AX4 series Wi-Fi routers, where the WPS (Wi-Fi Protected Setup) PIN and Wi-Fi password are protected by a password hash with insufficient computational effort. This flaw allows an attacker within wireless range to brute-force or otherwise recover the WPS PIN and subsequently the Wi-Fi password, leading to unauthorized network access. The vulnerability is currently unpatched, and no public exploit code or proof-of-concept is available. The CVSS score of 4.3 reflects the low complexity and network adjacency requirement, but the potential for lateral movement and data exfiltration elevates the risk for affected environments.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector (AV): Adjacent Network – attacker must be within Wi-Fi range.
• Attack Complexity (AC): Low – no special conditions required.
• Privileges Required (PR): None.
• User Interaction (UI): None.
• Scope (S): Unchanged.
• Confidentiality (C): Low – disclosure of WPS PIN and Wi-Fi password.
• Integrity (I): None.
• Availability (A): None.

Threat Level: Medium. While the direct impact is limited to credential disclosure, successful exploitation can lead to full network compromise, man-in-the-middle attacks, and further lateral movement.

Deep Dive & Mechanics

The vulnerability resides in the WPS implementation of the BUFFALO WSR-1800AX4 series routers. WPS uses an 8-digit PIN for authentication. The router’s firmware computes a hash of the PIN with insufficient computational effort (e.g., weak hashing algorithm, low iteration count, or lack of salting). This makes the hash susceptible to offline brute-force attacks.

Attack Flow:

1. Reconnaissance: Attacker scans for WPS-enabled networks using tools like wash or airodump-ng.
2. Capture: The attacker captures the WPS M1-M8 handshake messages, which include the hashed PIN.
3. Offline Brute-Force: Using the weak hash, the attacker performs an offline brute-force attack (e.g., with Reaver or Bully) to recover the PIN.
4. Credential Extraction: Once the PIN is known, the attacker can derive the Wi-Fi password (PSK) and connect to the network.

Root Cause: The use of a password hash with insufficient computational effort (likely a single round of MD5 or SHA-1 without salt) allows an attacker to test PIN candidates at high speed (millions per second) on modern hardware.

Vulnerable vs. Patched Code

No patched code is available. The vulnerable code is presumed to be in the router’s firmware, specifically in the WPS daemon (e.g., wscd or hostapd with WPS support). A secure implementation would use a key derivation function like PBKDF2 with a high iteration count (e.g., 40960) and a random salt.

Vulnerable (Conceptual):

// Weak hash - single SHA-1
char pin_hash[20];
SHA1(pin, 8, pin_hash);

Patched (Conceptual):

// Strong hash - PBKDF2 with high iterations
char pin_hash[32];
PKCS5_PBKDF2_HMAC_SHA1(pin, 8, salt, 16, 40960, 32, pin_hash);

Exploitation & Lab Setup

Red Team

Lab Setup:

• Hardware: BUFFALO WSR-1800AX4 router with WPS enabled.
• Attacker machine: Kali Linux with wireless card supporting monitor mode (e.g., Alfa AWUS036ACH).
• Tools: wash, airodump-ng, reaver, bully, hashcat.

Exploitation Steps:

1. Enable monitor mode:

   sudo airmon-ng start wlan0
   

2. Scan for WPS-enabled networks:

   sudo wash -i wlan0mon
   

3. Capture WPS handshake:

   sudo reaver -i wlan0mon -b <BSSID> -vv -S -N
   

   (Note: This may take hours; the weak hash allows offline cracking after capture.)
4. Extract hash and crack offline:

   # Assuming hash format: <BSSID>:<ESSID>:<PIN_HASH>
   hashcat -m 16800 -a 3 capture.hccapx ?d?d?d?d?d?d?d?d
   

Blue Team

Detection & Prevention:

• Disable WPS on all BUFFALO WSR-1800AX4 routers immediately.
• Monitor for WPS scanning activity using wireless IDS (e.g., Kismet).
• Deploy network segmentation to limit lateral movement from compromised Wi-Fi.
• Use WPA3 if supported, or enforce strong WPA2-PSK with complex passphrases.

Hunting:

• Look for repeated WPS M1 messages from unknown MAC addresses.
• Monitor for brute-force attempts via logs (if available) or wireless packet captures.

Indicators of Compromise (IOCs)

• Network:
  • Multiple WPS M1 messages from the same source MAC within a short period.
  • Unusual number of WPS EAPOL frames.
• Host:
  • Unknown devices connected to the Wi-Fi network.
  • Unauthorized ARP entries or DHCP leases.
• File:
  • Captured WPS handshake files (.cap, .hccapx) on attacker systems.
• Behavioral:
  • Sudden increase in failed WPS PIN attempts (if logged).

Detection Engineering

YARA Rule

rule CVE_2025_46413_WPS_Hash_Weakness {
    meta:
        description = "Detects weak WPS PIN hash in captured handshake files"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-46413"
    strings:
        $wps_hash = /[0-9a-f]{40}/  // SHA-1 hash length
        $wps_marker = "WPS"
    condition:
        $wps_marker and #wps_hash > 0
}

Sigma Rule

title: CVE-2025-46413 WPS Brute-Force Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects multiple WPS M1 messages from same source MAC
author: Valters IT
logsource:
    category: wireless
    product: wpa_supplicant
detection:
    selection:
        EventID: 1  # WPS M1 message
        SourceMAC: '*'
    condition: selection | count(SourceMAC) by SourceMAC > 10
falsepositives:
    - Legitimate WPS reconfiguration
level: medium

Suricata Rule

alert tcp any any -> any 80 (msg:"CVE-2025-46413 WPS PIN Brute-Force Attempt"; flow:to_server; content:"WPS"; content:"M1"; threshold:type both, track by_src, count 10, seconds 60; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable WPS on all BUFFALO WSR-1800AX4 routers via the web interface (Wireless > WPS > Disable).
2. Change Wi-Fi password to a strong, complex passphrase.
3. Update firmware if a patch becomes available (monitor BUFFALO support page).

Long-Term:

• Replace affected routers with models that support WPA3 and have no known WPS vulnerabilities.
• Implement network access control (NAC) to restrict unauthorized devices.
• Conduct regular vulnerability scans of network infrastructure.

Workaround: If WPS must be used, enable it only temporarily for device provisioning and disable it immediately after.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert