JVN#75028871: CG-WLR300GNV Series does not limit authentication attempts

CG-WLR300GNV and CG-WLR300GNV-W provided by Corega Inc are wireless LAN routers. The WPS functionality in CG-WLR300GNV Series does not limit PIN authentication attempts, making it susceptible to brute force attacks.

Impact

An unauthenticated attacker within wireless range of the device may perform a brute force attack to recover the PIN. Using the recovered PIN, the attacker may gain access to the network.

Solution

Apply a Workaround
The following workaround will mitigate this vulnerability.

• Disable the WPS functionality

Products Affected

• CG-WLR300GNV
• CG-WLR300GNV-W