Executive brief
A security misconfiguration in the TRENDnet TEW-WLC100P wireless controller allows attackers to intercept encrypted traffic. The device uses an insecure setting in its VPN component that exposes sensitive authentication data over the network. An attacker can capture this data and use it to crack the system's passwords offline, potentially gaining unauthorized access to the corporate network.
Technical details
The TRENDnet TEW-WLC100P (firmware 2.03b03) is vulnerable to an insecure default initialization (CWE-1188) because the 'i_dont_care_about_security_and_use_aggressive_mode_psk' option is enabled in the strongSwan configuration. This setting allows IKE Responders to use IKEv1 Aggressive Mode with Pre-Shared Keys (PSK). Because Aggressive Mode transmits a hash of the PSK before a secure channel is established, a remote unauthenticated attacker can capture this hash via network sniffing and perform an offline dictionary or brute-force attack to recover the cleartext PSK. Successful exploitation facilitates unauthorized VPN access and further network compromise.
Affected products
- TRENDnet TEW-WLC100P 2.03b03
Timeline
- 2025-07-21: disclosed
- 2025-07-21: advisory