US-CERT recently released Vulnerability Note VU#723755.


In short, this describes how modern wireless routers can have their PSKs discovered within just a matter of hours - even if they're using WPA2 with a strong PSK.

The exploit is done by abusing a design flaw in the Wi-Fi Protected Setup (WPS) feature that is common to most routers. The WPS PIN can be (relatively) easily brute-forced, and this can lead to revelation of the WPA2 PSK. This remains effective even if the victim changes their PSK. The only known work-around is to disable the WPS feature.

I personally don't use the WPS feature at all. I use randomly-generated 63-character PSKs which I either manually enter or cut-and-paste to client devices. The fact that there is a side-channel attack which can easily circumvent this protection bothers me a bit. So, I'd like to disable the WPS feature as suggested.

However, on my Linksys routers (WRT400N and E3000), I can't see a way to do that.

When I go to the Wireless section of my routers' configuration sites, (both appear the same, in regards to this post) I see this:

enter image description here

Below that is my basic wireless radio configuration options (Network Mode, Network Name (SSID), Channel Width, Wide Channel, Standard Channel, SSID Broadcast) for each of the 2.4 and 5 GHz bands. Nothing here, aside from the Wi-Fi Protected Setup radio button, addresses anything related to security.

If I go to the Wireless Security section, I only see the options for configuring my passphrase on each band. No mention of Wi-Fi Protected Setup in there.

However, if I select the Wi-Fi Protected Setup radio button under Basic Wireless Settings, I see this:

enter image description here

Obviously, I've obscured the PIN here. Also, below this section are configuration details of the WPA2 PSKs for each radio band. The key element I'm concerned with though, is where it says "Wi-Fi Protected Setup Status: Configured". Does this mean that my router still has the WPS service active, despite the fact that I'm not using it? If so, how can I disable it on this router? Is there an option I'm missing?

NOTE: I've checked and found a firmware update for the WRT400N, but the E3000 is already running the most current version. Also, I don't see anything in the Release Notes for the WRT400N's update which seems to be addressing my issue.

  • 2
    With it set to Manual the rest doesn't mean anything. They hold the previous values so you can turn it on/off without re-configuring it every time.
    – Brian
    Jan 4, 2012 at 18:49
  • @Brian According to Amoork - and I tend to agree - the Manual/WPS radio has no effect on whether the feature is enabled or not. It's simply the mechanism within the GUI that allows you to access the WPS configuration.
    – Iszi
    Jan 9, 2012 at 15:08

4 Answers 4


While not an ideal solution, installing the DD-WRT or Tomato custom firmwares will resolve this, as they do not implement WPS

  • I think there's an entire sub-culture that would disagree that this is "not an ideal solution". I'm not one of them though. Still, thanks for putting it out there.
    – Iszi
    Jan 9, 2012 at 16:13
  • Oh definitely, I'm part of the sub-culture that would entirely recommend going the custom firmware route, it's not everyone's cup of tea though :)
    – benwh
    Jan 9, 2012 at 16:16
  • Giving up on waiting for firmware updates, I think I'm going to go with this route. Thanks for the suggestion.
    – Iszi
    Feb 3, 2012 at 19:47

As of 1/9/2012, there is no way to fully disable WPS on Linksys products.

See: http://www.smallnetbuilder.com/wireless/wireless-features/31664-waiting-for-the-wps-fix



MAC address filtering offers some protection, but can easily be bypassed.


I have the E3000 router and have also been looking for a way to disable it, and as far as my research goes, it is currently not possible (with FW 1.0.04).

That "Manual" switch only affects the GUI, if you look at the beacon (with some WiFi Analyzer) you will notice that WPS is still enabled.

UPDATE: Take a look at here. The guy there basically states (about E3000) that "Vulnerable: YES - however, the WDS falls over quickly so it is not very practical to attack a router.", so thanks to it's vulnerability to denial of service, it withstands the WPS attack...

Information about other routers is also listed in his public google spreadsheet.

  • This is what I suspected. One of these days, I'm going to get a Wi-Fi NIC capable of packet injection so I can test these things for real.
    – Iszi
    Jan 6, 2012 at 14:08

Cisco announced dates for firmware releases which allow Disabling WPS. Both E3000 and WRT400N remain To Be Determined, but some models list "early March".


They suggest disabling all wifi in the meantime. Thanks, Cisco!

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .