Kr00k wireless vulnerability

[jgbright]

Cisco has identified 14 wireless devices so far that are vulnerable to the new Kr00k vulnerability (CVE-2019-15126)

https://www.bleepingcomputer.com/news/security/cisco-working-on-patches-for-new-kr00k-wifi-vulnerability/

No mention of any Meraki wireless equipment yet.

Has anybody heard differently yet?

[daviscot]

I have not heard any reports of Meraki APs being affected but will double check. All of the recent and current APs do not use Broadcom or Cypress chipsets and are not vulnerable, but some of the older End-of-Sale APs had Broadcom, that's what I'll check on and get back to you.

[Prateek Maheshwari]

Yes, you right,

I also didn't face any vulnerability in our environment. And didn't get any update from Meraki side.

[jgbright]

And here's the link to the Cisco announcement:

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200226-wi-fi-info-disclosure

[Nolan H.]

I was going to say, Meraki uses Qualcomm so they should not be affected

[aneduzhk]

This is being accessed by our Security Team. Updates to follow.

[aneduzhk]

Meraki is aware of the CVE-2019-15126 vulnerability (also commonly known as Kr00k). At this time, Meraki is evaluating the impact and the affected products (if any). We will provide updates as we make progress to ensure the security of our products.

[aneduzhk]

Update:

None of our orderable 802.11ac Wave 2 (MR20, MR33, MR30H, MR42, MR52, MR53, MR42E, MR53E, MR70, MR74, MR84) or 802.11ax (WiFi-6) Access Points (MR45, MR55, MR36, MR46, MR56) are susceptible to this vulnerability.

Older APs not listed above may be affected, and more updates on those SKUs will be provided soon.

[Nolan H.]

Thank you for the update @aneduzhk

[JoshBarfield]

Any further updates on other SKUs, @aneduzhk? Is there an official source for information on this issue?

[aneduzhk]

Still in progress. We are in uncharted territory right now with the global coronavirus pandemic, so we should expect responses to/from other teams that are involved to be delayed. I hope you understand. Thanks.

[aneduzhk]

Cisco Meraki Customer Advisories page has been updated with the relevant information.

[CMR]

A quick summary:

WPA2 security can be bypassed on some devices.

For the MX64W and MX65W you need 15.28 to no longer be vulnerable.

For the MR26, MR32, MR34 and MR72 you need 26.8, which is due to be available in May.

Boy, am I glad we are in lockdown, we have ~30 affected devices and our corporate SSID currently uses WPA2!

[daviscot · Accepted solution]

@jgbright just wanted to come back and close the loop on this one regarding kr00k (CVE ID: CVE-2019-15126, CVSSv3 Base Score: 3.1) that hit back in late February. Meraki MR26, MR32, MR34 and MR72 and MX64W, MX65W use the impacted chips and are affected by this vulnerability.

More info here.

https://documentation.meraki.com/zGeneral_Administration/Privacy_and_Security/FullMAC_Wi-Fi_chipsets_vulnerability_(kr00k)

and

https://meraki.cisco.com/blog/cisco-meraki-customer-advisories/

[anythinghosted]

Version 26.8 now available to upgrade.

Looks like it's also the initial stable firmware for some unreleased access points too ... unless I've missed a webinar.