Zyxel security advisory for the key management vulnerabilities of WPA2 protocol

Zyxel_Forum_AdminZyxel_Forum_Admin Posts: 76  Admin
edited January 15, 2019 2:15PM in News and Release

Zyxel is aware of the recently found key management vulnerabilities of the WiFi Protected Access II (WPA2) security protocol, as identified in US-CERT vulnerability  note VU#228519, with the vulnerability IDs listed in table 1.

What are the vulnerabilities?

These vulnerabilities affect wireless products that connect to WiFi networks in different ways, depending on the role of products as WiFi clients or servers, as described in table 1 below.

Table 1.

Type of attack


Devices impacted

4-way handshake


WiFi clients

Group-key handshake







WiFi clients

802.11r Fast-BSS Transition (FT)


Access points

Peer-key handshake



WiFi clients


It is important to note that an attacker has to be physically nearby and is within the wireless range to exploit these weaknesses.[1]

Please see: https://www.krackattacks.com/#details for more technical information.

How are Zyxel resolving the vulnerabilities?

At Zyxel we treat security as a top priority and we have conducted a thorough investigation and identified a list of vulnerable products within their warranty and support period, as shown in table 2 below. For products not listed, they are not affected to the attacks either because they are not designed to act as WiFi clients, do not support 802.11r Fast-BSS Transition handshake, or do not support peer-key handshake by default.

We are now co-working with WiFi chipset vendors to create a solution, and the patch firmware will be available in the next few weeks or even sooner, provided WiFi chipset vendors will release their patches much earlier. 

Please refer to table 2 for the detailed release schedule.

Table 2

Devices Impacted


Hotfix Availability

Standard Availability

WiFi Clients


31-Dec 2017

Feb 2018 or sooner

Access Points


16-Nov 2017

Feb 2018 or sooner


16-Nov 2017

Feb 2018 or sooner


16-Nov 2017

Feb 2018 or sooner

WAC6500 series*

16-Nov 2017

Feb 2018 or sooner

* The above Access Points (NWA5301-NJ, NWA5123-AC, WAC6103D-I, WAC6500 series) are only affected when managed by NXC2500/5500 with 802.11r enabled. Note that when the mentioned Access Points in standalone mode are not affected because 802.11r is not supported in this mode and therefore, there is no hotfix/solution required. So the available hotfix we release is for NXC2500/NXC5500.

Please click on the link below to download the hotfix for NXC2500/NXC5500. 

Download hotfix for NXC2500

Download hotfix for NXC5500

What should I do now to protect myself against the vulnerabilities?

As mentioned previously - It is important to note that an attacker has to be physically nearby and is within the wireless range to exploit these weaknesses. As our Business class Access Points support the 802.11r Fast-BSS Transition (FT) handshake, devices supporting this feature are listed in the vulnerability list (table 2). By default, the 802.11r is not enabled in Zyxel Products or Controllers; and the majority of Zyxel customers will not be affected.

For customers who have enabled 802.11r, who are concerned about the security risks, they should disable the 802.11r feature to prevent an attack from taking place. Once the Hotfix has been released, clients wishing to use the 802.11r feature are advised to update as soon as possible to ensure the vulnerability does not affect the security of their network.

For more information and technical details regarding the vulnerabilities please see below references:

1.      US-CERT VU note: https://www.kb.cert.org/vuls/id/228519/

2.      Disclosure by by Mathy Vanhoef of imec-DistriNet of KU Leuven: https://www.krackattacks.com/

Zyxel will update this advisory when more information is available. 


  • kidalabamakidalabama Member Posts: 5  Freshman Member
    I have got nwa1100-nh ap but known issues not resolved long time.

    Known Issue:
    1.[Spec issue] Users will not be able to select channel when wireless interface is disabled.
    2.[Spec issue] The log should not be cleared after AP reboot.
    3.[Spec issue] When device operating in client mode , LAN port device will not get IP address when the  DHCP server uses unicast.
    4. Sometimes Telnet service is not available after changing secure access control settings on AP.

  • Zyxel_JoslynZyxel_Joslyn Zyxel Official Agent Posts: 101  mod
    edited May 7, 2018 4:49PM
    Hi @kidalabama

    Thanks for your sharing. Here is our reply for each item.
    1. When the interface is enable, we can select the channel.
    2. We support syslog server and email. You can send out the logs via the settings.
    3. Almost of the servers are using broadcast now. You can use static IP address if needed.
    4. NXC and AP support GUI. We can configure all the settings via GUI. Do you have any specific usage which must under Telnet?
    By the way, since this place is for new and release, you can post your comment at discussions. 
    Here is the link.

  • kidalabamakidalabama Member Posts: 5  Freshman Member
    edited December 3, 2018 8:02PM


  • HedyHedy Member Posts: 5  Freshman Member
    I deployed several NWA1100-NH in my environment. All of them are DHCP clients; however, I did not meet the issue as the spec described. I thought most of the DHCP servers are using broadcast, not unicast. If you meet the DHCP server using unicast, I thought applying static IP address is also a good idea because it is easy to manage APs. No worry about losing the DHCP table. Or maybe use another DHCP server with broadcast?
  • kidalabamakidalabama Member Posts: 5  Freshman Member
    edited December 6, 2018 9:23PM
    i am using as client mode.  zyxel is detected this problem and writing new firmware info as described KNOWN ISSUES. but not created new firmware with solved known issues. zyxel=problem.
  • Zyxel_JoslynZyxel_Joslyn Zyxel Official Agent Posts: 101  mod

    We know the issue; however, there is no fix plan so far. So, we have two suggestions for you to resolve this kind of situation.
    1. Use static IP address for each client.
    2. Use a DHCP server with broadcast flag.
    Apologize to cause you any inconvenience.

  • kidalabamakidalabama Member Posts: 5  Freshman Member
    Please add fix plan. I am already added static ip but this is very hard.
  • Zyxel_JoslynZyxel_Joslyn Zyxel Official Agent Posts: 101  mod

    We don't have fix plan for this issue. Please use our suggestion as workaround.
    Apologize to cause your any inconvenience.

Sign In to comment.