Frag Attack Security Information

To all Digi International Customers,

Digi’s Security Team has been reviewing nine related CVEs, more commonly known as Frag Attack. Frag Attack, or fragmentation and aggregation attacks, states that an adversary who is within range of a victim's Wi-Fi network can abuse these vulnerabilities to steal user information or attack devices.

These vulnerabilities are difficult to perform and carry out because most require a combination of being able to inject 802.11 frames, successfully complete a MITM attack, and successfully socially engineer the victim into bypassing browser warnings about a link or visiting a site hosted by a malicious server. For all the above to succeed, the attacker would need to be sophisticated, onsite, and armed with specialized hardware and software. The Digi Security Team has found that many vendors have released patches or ways to mitigate against these CVEs. Listed below are recommended ways to mitigate against the Frag Attack vulnerabilities on Digi International devices.

Recommended mitigations:

To mitigate against Frag Attack Digi suggests doing the following:

1. By default, the product enables HTTPS.
2. Use WPA3 – Enabling WPA3 automatically enables 802.11w-protected management frames, which prevents rogue deauthorization/disassociation frames from impacting the AP-client connection. *(if WPA3 is not available use a or b)*
   1. WPA2 Personal is the default encryption type for Wi-Fi access points on DAL devices
   2. Supports WPA2-PSK
3. Use EAP-TLS – This ensures that the client authenticates the network before joining.
   1. RADIUS-based authentication for enterprise access points.
   2. RADIUS-based authentication (client mode)
   3. DAL, only for client-mode connections (i.e., where the DAL device is connecting to another router's SSID), not for its own access points.
   4. Certificate-based authentication is done via PEAP with MSCHAPv2
   5. EAP-TTLS/PAP, EAP-TTLS/MSCHAPv2 authentication.

If any further vulnerability paths have been discovered regarding the Wi-Fi Frag Attack, please submit the vulnerability on our Digi Security Notification site. To ensure communication please submit your email with the form.

Thank you,

Digi International Security Team

°More devices/platforms will be added throughout the year.