Decade-Old Pixie Dust Wi-Fi Hack Still Impacts Many Devices

According to NetRise, 20 device models from six vendors remain vulnerable to the Pixie Dust Wi‑Fi attack, with TP-Link accounting for about half of the models analysed. NetRise’s study of 24 routers, access points, range extenders and powerline/Wi‑Fi hybrids found that only four have been patched, and many fixes arrived after 9–10 years; seven affected products have reached end of life, while 13 are still supported. The analysis also showed that the WPS PIN could be recovered in 1–2 seconds in the tests.

The Pixie Dust exploit involves capturing the initial WPS handshake from a in‑range target to crack the PIN offline, leveraging low‑entropy or predictable random numbers in some devices. The findings come as CISA warned that an old missing authentication vulnerability affecting TP‑Link Wi‑Fi range extenders has been exploited in the wild, underscoring ongoing supply‑chain and firmware security concerns.

NetRise described the persistence of vulnerable WPS implementations as reflecting a systemic flaw in firmware supply chains, with enterprises potentially exposed in high‑trust environments and dependent on vendor disclosures that may not always materialise.