JVN#25674893: WN-GDN/R3 Series does not limit authentication attempts

WN-GDN/R3 series provided by I-O DATA DEVICE, INC. is a wireless LAN router. WPS functionality in WN-GDN/R3 Series does not limit PIN authentication attempts, making it susceptible to brute force attacks.

Impact

An unauthenticated attacker within wireless range of the device may perform a brute force attack to recover the PIN. Using the recovered PIN, the attacker may gain access to the network.

Solution

Apply a Workaround
The following workaround will mitigate this vulnerability.

• Disable the WPS functionality

Products Affected

• WN-GDN/R3
• WN-GDN/R3-S
• WN-GDN/R3-U
• WN-GDN/R3-C