Multiple security issues and vulnerabilities within the WPA2 standard have been identified and publicized by Mr. Mathy Vanhoef of KU Leuven. These vulnerabilities may allow the reinstallation of a pairwise transient key, a group key, or an integrity key on either a wireless client or a wireless access point (AP). In consequence, an attacker could establish a man-in-the-middle position between AP and client facilitating packet decryption and injection.

Update A - 2017-11-09
* Added a detailed list of affected products

Update B - 2018-09-24
* Added firmware update information, see section "Solution"

PHOENIX CONTACT embedded devices running in AP mode are not affected by these vulnerabilities. If devices are used in client or repeater mode, an attacker could in theory decrypt any packet sent by the client. Devices of the FL WLAN 110x, 210x, and 510x product families are only affected to a very limited extent. With these devices, only data packets sent within three seconds after key renewal could possibly be decrypted by a successful attacker. In general, if TCP SYN packets are decrypted, this can be used to hijack TCP connections and inject malicious traffic into unencrypted protocols. However, to perform the attack, the attacker must be significantly closer to the WLAN client than the access point. In industrial or indoor applications, the attacker would have to be inside the plant. A successful external attack therefore seems to be very difficult. Furthermore, the WPA2 password cannot be compromised using a KRACK attack. It is not possible for the attacker to gain full access to the network. However, note that if WPA-TKIP is used instead of AES-CCMP, the impact of this vulnerability is much more severe, because an attacker can then not only decrypt packets, but also forge and inject packets directly into the WLAN.

PHOENIX CONTACT is actively working on these vulnerabilities. CERT@VDE will update this advisory as soon as further significant details are provided by the vendor, especially with information about patches provided.

For PHOENIX CONTACT devices running Microsoft Windows, we recommend to apply the security update provided by Microsoft. If you are using WPA-TKIP in your WLAN, you should switch to AES-CCMP immediately.

This advisory will be updated as further details become available.

For the following products a firmware update addressing the issues is available for download on the Download tab of the corresponding product page on our website:

Mathy Vanhoef of imec-DistriNet, KU Leuven published this vulnerability on https://www.krackattacks.com.

PHOENIX CONTACT reported this vulnerability to CERT@VDE.