Tuesday, May 13, 2025
Homecyber securityKr00k - New Wi-Fi Vulnerability Let Hackers Decrypt WPA2-Encrypted Traffic - Billion...

Kr00k – New Wi-Fi Vulnerability Let Hackers Decrypt WPA2-Encrypted Traffic – Billion of Devices Affected

Published on

SIEM as a Service

Follow Us on Google News

Kr00k, a security flaw in Wi-Fi chips allows attackers to decrypt the WPA2-encrypted traffic.

The vulnerability affects Broadcom and Cypress chips, these are the most common chips used by several client devices including top brands such as Amazon (Echo, Kindle), Apple (iPhone, iPad, MacBook), Google (Nexus), Samsung (Galaxy) and others.

Not only client devices this vulnerability also affects the Wi-Fi Access points and routers.

- Advertisement - Google News

Kr00k Vulnerability

Security researchers from ESET discovered the vulnerability dubbed Kr00k and assigned CVE-2019-15126. An attacker can exploit the vulnerability by eavesdropping the communication of an unpatched device.

If the attack is successful then attackers can exfiltrate sensitive data from the target device. The attack abuses implementation flaws with Wi-Fi chips.

Generally, packets are encrypted with a unique key based on the Wi-Fi network password. When a device disassociated from the Wi-Fi network, with the vulnerable chips keys are zeroed out and then buffered data sent with zero encryption.

Kr00k Vulnerability

By triggering the disassociation continuously the attacker can decrypt some wireless network packets transmitted by a vulnerable device.

The vulnerability affected both WPA2-Personal and WPA2-Enterprise protocols, with AES-CCMP encryption.

Kr00k also related to KRACK vulnerability which was founded in 2017. “Kr00k is one of the possible reasons behind the “reinstallation” of an all-zero TK, which has been observed while testing for KRACK attacks.”

Here is the difference between KRACK and Kr00k

Kr00k Vulnerability

ESET reported the vulnerability to chip manufacturers Broadcom and Cypress who fixed the issue, also ESET worked ICASI to make sure all the vendors aware of Kr00k.

The vulnerability is no way associated with the Wi-Fi password, changing the Wi-Fi password is not a fix for the vulnerability.

If you are using affected chips, it is recommended to update devices with Broadcom or Cypress chips to the latest software versions.

Device manufacturers are recommended to chip manufacturer for details about patches for the Kr00k vulnerability.

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Apple Releases Security Patches to Fix Critical Data Exposure Flaws

Apple released critical security updates for macOS Sequoia 15.5 on May 12, 2025, addressing...

Lumma Stealer Upgraded with PowerShell Tools and Advanced Evasion Techniques

Sophos Managed Detection and Response (MDR) in September 2024, the notorious Lumma Stealer malware...

New Noodlophile Malware Spreads Through Fake AI Video Generation Platforms

Cybercriminals have unleashed a new malware campaign using fake AI video generation platforms as...

Kimsuky Hacker Group Deploys New Phishing Techniques and Malware Campaigns

The North Korean state-sponsored Advanced Persistent Threat (APT) group Kimsuky, also known as “Black...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Apple Releases Security Patches to Fix Critical Data Exposure Flaws

Apple released critical security updates for macOS Sequoia 15.5 on May 12, 2025, addressing...

Lumma Stealer Upgraded with PowerShell Tools and Advanced Evasion Techniques

Sophos Managed Detection and Response (MDR) in September 2024, the notorious Lumma Stealer malware...

New Noodlophile Malware Spreads Through Fake AI Video Generation Platforms

Cybercriminals have unleashed a new malware campaign using fake AI video generation platforms as...