Executive brief
The EZCast Pro II, a wireless display dongle used for presentations, uses a predictable method to generate its default Wi-Fi password. An attacker within physical Wi-Fi range can calculate this password using visible device information to gain unauthorized access to the device's network. This could allow an attacker to intercept presentation data or gain a foothold on the local network.
Technical details
The EZCast Pro II (before version 1.17478.177) suffers from a use of insufficiently random values (CWE-330) in its Access Point functionality. The default Wi-Fi password is generated using a predictable algorithm based on observable device identifiers, such as the SSID or MAC address. An attacker within Wi-Fi range can calculate the password and connect to the dongle's wireless network without prior authorization. Once connected, the attacker may be able to access the administrative interface or intercept traffic. The issue is addressed in firmware version 1.17478.177, which implements a more secure default password format and mandates password changes.
Affected products
- NimbleTech EZCast Pro II Dongle before 1.17478.177
Timeline
- 2025-12-10: disclosed: Initial disclosure by Swiss NCSC
- 2025-12-10: advisory
- 2026-05-28: patched: Vendor release notes confirm fix in version 1.17478.177