CVE-2019-12941: AutoPi Wi-Fi/NB and 4G/LTE devices before 2019-10-15 allows an attacker to perform a brute-force attack or dictionary attack to gain access to the WiFi…

PriorityP262critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EPSS

2.38%

81.8th percentile

AutoPi Wi-Fi/NB and 4G/LTE devices before 2019-10-15 allows an attacker to perform a brute-force attack or dictionary attack to gain access to the WiFi network, which provides root access to the device. The default WiFi password and WiFi SSID are derived from the same hash function output (input is only 8 characters), which allows an attacker to deduce the WiFi password from the WiFi SSID.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
autopi	4g_lte_firmware	< 2019-10-15	2019-10-15
autopi	wi-fi_nb_firmware	< 2019-10-15	2019-10-15

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.