Study: Vulnerabilty to old Pixie Dust Wi-Fi attack persists

Only four of two dozen networking devices currently in use have been remediated against the Pixie Dust attack involving the exploitation of a Wi-Fi Protected Setup-related flaw to compromise wireless networks without needing their credentials, according to SecurityWeek.

Most of the patches against the attack, which was initially discovered in 2014, arrived nine to 10 years later, a report from software and firmware supply chain security firm NetRise revealed.

With 20 router, range extender, access point, and other Wi-Fi system models still unpatched, millions of devices could still be vulnerable to Pixie Dust, noted NetRise researchers, who also warned of silent exploit paths that could prevent reliable detection among enterprises.

"The persistence of vulnerable WPS implementations reflects a systemic flaw in firmware supply chains. Vendors reuse insecure libraries, fail to enforce secure defaults, and provide little transparency. This exposes manufacturers to reputational damage, potential regulatory action, and legal liability," said NetRise.