WPA2 Security (KRACKs) Vulnerability Statement
TP-Link is aware of vulnerabilities in the WPA2 security protocol that affect some TP-Link products. An attacker within wireless range of a Wi-Fi network can exploit these vulnerabilities using key reinstallation attacks (KRACKs). According to the research paper on KRACKs by Mathy Vanhoef that brought this vulnerability to the attention of vendors, the attack targets the WPA2 handshake and does not exploit access points, but instead targets clients. All vulnerabilities can be fixed through software updates since the issues are related to implementation flaws.
TP-Link has been working to solve this problem and will continue to post software updates at: www.tp-link.com/support.html. Products with TP-Link Cloud enabled will receive update notifications in the web management interface, Tether App or Deco App automatically.
More information about KRACK can be found through the link: https://www.krackattacks.com.
Note that the following two conditions must exist in order for the KRACK vulnerability to be exploited:
- Physical Proximity: An attack can only happen when an attacker is in physical proximity to and within wireless range of your network.
- Time Window: An attack can only happen when a client device is connecting or reconnecting to a Wi-Fi network.
Unaffected TP-Link products:
All powerline adapters
All mobile Wi-Fi products
Routers and gateways working in their default mode (Router Mode) and AP Mode
Range extenders working in AP Mode
Business Wi-Fi EAP series access points working on AP mode
Affected TP-Link products:
Routers working in Repeater Mode/WISP Mode/Client Mode：
TL-WR940N with firmware version 3.17.1 Build 170717 Rel.55495n or earlier (Hardware Version 3.0 or earlier not affected)
TL-WR841Nv13 with firmware version 0.9.1 4.16 v0348.0 Build 170814 Rel.59214n or earlier (Hardware Version 12.0 or earlier not affected)
TL-WR840N with firmware version 0.9.1 4.16 v019a.0 Build 170524 Rel.56478n or earlier (Hardware Version 2.0 or earlier not affected)
TL-WR941HP with firmware version 3.16.9 Build 20170116 Rel.50912n or earlier
TL-WR841HP with firmware version 3.16.9 Build 160612 Rel.67073n or earlier
TL-WR902AC with firmware version 3.16.9 Build 20160905 Rel.61455n or earlier
TL-WR802N with firmware version 0.9.1 3.16 v0188.0 Build 170705 Rel.34179n or earlier
TL-WR810N with firmware version 3.16.9 Build 160801 Rel.57365n or earlier
Routers with WDS function enabled (disabled by default) may be affected. Refer to the FAQ to learn how to check if WDS is enabled on your router.
Range Extenders working in Repeater Mode during a WPA2 handshake that is initiated only when connecting or reconnecting to a router:
TL-WA850RE with firmware version 1.0.0 Build 20170609 Rel.34153 or earlier
TL-WA855RE with firmware version 1.0.0 Build 20170609 Rel.36187 or earlier
TL-WA860RE with firmware version 1.0.0 Build 20170609 Rel.38491 or earlier
RE200 with firmware version 1.1.3 Build 20170818 Rel.58183 or earlier
RE210 with firmware version 3.14.2 Build 160623 Rel.43391n or earlier
RE305 with firmware version 1.0.0 Build 20170614 Rel.42952 or earlier
RE450 with firmware version 1.0.2 Build 20170626 Rel.60833 or earlier
RE500 with firmware version 1.0.1 Build20170210 Rel.59671 or earlier
RE650 with firmware version 1.0.2 Build 20170524 Rel.58598 or earlier
Whole Home Wi-Fi System:
Deco M5 with firmware version 1.1.5 Build 20170820 Rel.62483 or earlier
Business VPN Router/CPE/WBS/CAP:
CAP300 with firmware version 1.1.0 Build 20170601 Rel.60253 or earlier
CAP300-Outdoor with firmware version 1.1.0 Build 20170601 Rel.60212 or earlier
CAP1750 with firmware version 1.1.0 Build 20170601 Rel.60196 or earlier
CAP1200 with firmware version 1.0.0 Build 20170801 Rel.61314 or earlier
TL-ER604W with firmware version 1.2.0 Build 20160825 Rel.45880 or earlier
CPE520 with firmware version 2.1.6 Build 20170908 Rel.45234 or earlier
CPE610 with firmware version 2.1.5 Build 20170830 Rel. 58245 or earlier
CPE510 with firmware version 2.1.6 Build 20170908 Rel. 45233 or earlier
CPE220 with firmware version 2.1.6 Build 20170908 Rel. 45233 or earlier
CPE210 with firmware version 2.1.6 Build 20170908 Rel. 45234 or earlier
WBS210 with firmware version 2.1.0 Build 20170609 Rel. 57434 or earlier
WBS510 with firmware version 2.1.6 Build 20170908 Rel. 45234 or earlier
Smart home devices:
Smart Plugs and Switch: HS100, HS105, HS110, HS200
Smart Bulbs: LB100, LB110, LB120, LB130, LB200, LB230
Smart Repeater with Plugs: RE350K, RE270K, RE370K
Cameras: NC250, NC260, NC450, KC120
How to protect your devices
Until a software update is available to eliminate the vulnerability for your product, it is recommended to take the following precautions:
For wireless routers: Make sure your routers are in Router Mode or AP Mode, and patch the operating system of your smartphones, tablets and computers.
For wireless adapters: Patch the operating system of your computers.
Microsoft security update: Microsoft has fixed such security issues as mentioned in https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-13080
TP-Link has been working on affected models and will release firmware over the next few weeks on our official website.
Associated CVE identifiers
The following Common Vulnerabilities and Exposures (CVE) identifiers have been assigned to track which products are affected by specific types of key reinstallation attacks:
- CVE-2017-13077: Reinstallation of the pairwise encryption key (PTK-TK) in the 4-way handshake
- CVE-2017-13078: Reinstallation of the group key (GTK) in the 4-way handshake
- CVE-2017-13079: Reinstallation of the integrity group key (IGTK) in the 4-way handshake
- CVE-2017-13080: Reinstallation of the group key (GTK) in the group key handshake
- CVE-2017-13081: Reinstallation of the integrity group key (IGTK) in the group key handshake.
- CVE-2017-13082: Accepting a retransmitted Fast BSS Transition (FT) Reassociation Request and reinstalling the pairwise encryption key (PTK-TK) while processing it
- CVE-2017-13084: Reinstallation of the STK key in the PeerKey handshake
- CVE-2017-13086: reinstallation of the Tunneled Direct-Link Setup (TDLS) PeerKey (TPK) key in the TDLS handshake
- CVE-2017-13087: reinstallation of the group key (GTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame
- CVE-2017-13088: reinstallation of the integrity group key (IGTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame
WPA2 vulnerabilities will remain if you do not take all recommended actions. TP-Link will not bear any responsibility for consequences that could have been avoided by following the recommendations in this statement.
Your feedback helps improve this site.