Skip to content
OpenAdvisories
High VDE-2017-005 9 CVEs

Pepperl+Fuchs / ecom instruments: WLAN enabled products utilizing WPA2 encryption

Published Dec 11, 2017 · Updated Oct 23, 2018 · Revision 2

Vendor: Android Product: FOTA-Update

Summary

Multiple security issues and vulnerabilities within the WPA2 standard have been identified and publicized by Mr. Mathy Vanhoef of KU Leuven. These vulnerabilities may allow the reinstallation of a pairwise transient key, a group key, or an integrity key on either a wireless client or a wireless access point (AP). In consequence, an attacker could establish a man-in-the-middle position between AP and client facilitating packet decryption and injection.

ecom instruments is a subsidiary company of PEPPERL+FUCHS.

Details

Impact
ecom instruments devices are in theory attackable by replay, decryption and forging of packets. However, to perform the attack, the attacker must be significantly closer to the ecom device than to the access point. The WPA2 password cannot be compromised using a KRACK attack. Note if WPA-TKIP is used instead of AES-CCMP, an attacker can easily forge and inject packets directly into the WLAN.

Remediation
### Android

**Affected Products:**
Tab-Ex 01, Ex-Handy 09, Ex-Handy 209, Smart-Ex 01, Smart-Ex 201

Pepperl+Fuchs has released firmware updates for the following products:

| Product | Date | Update Source |
|---------------|-----------------------|----------------|
| Smart-Ex 01 | Available since 09/2018 | FOTA-Update |
| Smart-Ex 201 | Available since 10/2018 | FOTA-Update |

---

### Windows

**Affected Products:**
Pad-Ex 01, i.roc Ci70-Ex, CK70A-ATEX, CK71A-ATEX, CN70A-ATEX, CN70E-ATEX

For *ecom instruments* devices running Windows, we recommend to apply the security update provided by Microsoft.
If you are using **WPA-TKIP** in your WLAN, you should switch to **AES-CCMP** immediately.

> **Note:**
> This advisory will be updated as further details and/or software updates become available.

Vulnerabilities 9

Revision history

  1. #1.1.0

    Firmware for Android based devices now available.

  2. #1.0.0

    Initial revision.

References