Skip to content
OpenAdvisories
Medium VDE-2017-003 3 CVEs

PHOENIX CONTACT: WLAN enabled devices utilising WPA2 encryption

Published Nov 9, 2017 · Updated May 14, 2025 · Revision 5

Vendor: Phoenix Contact Product: BL2 BPC 1000 Product: BL2 BPC 2000 Product: BL2 PPC 2000 Product: FL COMSERVER WLAN 232/422/485 Product: FL EPA 2 Product: FL EPA 2 RSMA Product: FL WLAN 1100 Product: FL WLAN 1101 Product: FL WLAN 2100 Product: FL WLAN 2101 Product: FL WLAN 230 AP 802-11-US Product: FL WLAN 230 AP 802-11* Product: FL WLAN 24 DAP 802-11 Product: FL WLAN 24 EC 802-11 Product: FL WLAN 5100 Product: FL WLAN 5101 Product: FL WLAN 5102 Product: FL WLAN 5110 Product: FL WLAN 5111 Product: FL WLAN EPA Product: FL WLAN EPA 5N Product: FL WLAN EPA RSMA Product: FL WLAN SPA Product: ITC 8113 Product: ITC 8113 PW7 Product: ITC 8113 PW7U Product: ITC 8113 PWES8 Product: ITC 8113 PWES8U Product: ITC 8113 SW7 +22 more

Summary

Multiple security issues and vulnerabilities within the WPA2 standard have been identified and publicized by Mr. Mathy Vanhoef of KU Leuven. These vulnerabilities may allow the reinstallation of a pairwise transient key, a group key, or an integrity key on either a wireless client or a wireless access point (AP). In consequence, an attacker could establish a man-in-the-middle position between AP and client facilitating packet decryption and injection.

Update A / Revision 2 - 2017-11-09
* Added a detailed list of affected products

Update B / Revision 3 - 2018-09-24
* Added firmware update information, see section "Solution"

Details

Impact
PHOENIX CONTACT embedded devices running in AP mode are not affected by these vulnerabilities. If devices are used in client or repeater mode, an attacker could in theory decrypt any packet sent by the client. Devices of the FL WLAN 110x, 210x, and 510x product families are only affected to a very limited extent. With these devices, only data packets sent within three seconds after key renewal could possibly be decrypted by a successful attacker. In general, if TCP SYN packets are decrypted, this can be used to hijack TCP connections and inject malicious traffic into unencrypted protocols. However, to perform the attack, the attacker must be significantly closer to the WLAN client than the access point. In industrial or indoor applications, the attacker would have to be inside the plant. A successful external attack therefore seems to be very difficult. Furthermore, the WPA2 password cannot be compromised using a KRACK attack. It is not possible for the attacker to gain full access to the network. However, note that if WPA-TKIP is used instead of AES-CCMP, the impact of this vulnerability is much more severe, because an attacker can then not only decrypt packets, but also forge and inject packets directly into the WLAN.

Remediation / Solution
PHOENIX CONTACT is actively working on these vulnerabilities. CERT@VDE will update this advisory as soon as further significant details are provided by the vendor, especially with information about patches provided.

For PHOENIX CONTACT devices running Microsoft Windows, we recommend to apply the security update provided by Microsoft external link. If you are using WPA-TKIP in your WLAN, you should switch to AES-CCMP immediately.

This advisory will be updated as further details become available.

For the following products a firmware update addressing the issues is available for download on the Download tab of the corresponding product page on our website:

Products: FL EPA 2, FL EPA 2 RSMA
Fixed Firmware: 1.53 or higher
Released: 06/2018

Products: FL WLAN 5100, FL WLAN 5101, FL WLAN 5102, FL WLAN 5110, FL WLAN 5111
Fixed Firmware: FW 3.06 or higher
Released: 06/2018

Products: FL WLAN 1100, FL WLAN 1101, FL WLAN 2100, FL WLAN 2101
Fixed Firmware: FW 2.21 or higher
Released: 06/2018

Vulnerabilities 3

Revision history

  1. #5

    Fix: version space, removed ia, version term

  2. #4

    Fix: correct certvde domain, added self-reference

  3. #3

    Updated Solution.

  4. #2

    Updated affected products.

  5. #1

    Initial revision.

References