AutoPi Wi-Fi/NB and 4G/LTE devices before 2019-10-15 allows an attacker to perform a…
Priority MEDIUM 47CWE-307Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-307.
Summary
AutoPi Wi-Fi/NB and 4G/LTE devices before 2019-10-15 allows an attacker to perform a brute-force attack or dictionary attack to gain access to the WiFi network, which provides root access to the device. The default WiFi password and WiFi SSID are derived from the same hash function output (input is only 8 characters), which allows an attacker to deduce the WiFi password from the WiFi SSID.
Why it matters now
EPSS 0.02377 83rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:autopi:wi-fi\/nb_firmware:*:*:*:*:*:*:*:* | before 2019-10-15 | Vulnerable | Autopi |
| cpe:2.3:h:autopi:wi-fi\/nb:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Autopi |
| cpe:2.3:o:autopi:4g\/lte_firmware:*:*:*:*:*:*:*:* | before 2019-10-15 | Vulnerable | Autopi |
| cpe:2.3:h:autopi:4g\/lte:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Autopi |
- cpe:2.3:o:autopi:wi-fi\/nb_firmware:*:*:*:*:*:*:*:* Versions before 2019-10-15 Vulnerable ·Autopi
- cpe:2.3:h:autopi:wi-fi\/nb:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Autopi
- cpe:2.3:o:autopi:4g\/lte_firmware:*:*:*:*:*:*:*:* Versions before 2019-10-15 Vulnerable ·Autopi
- cpe:2.3:h:autopi:4g\/lte:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Autopi
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2019-12941
- 2026-10-03 Alias added: GHSA-5vr6-c6xh-j699
References
Sources
- CVE-2019-12941 · CVE Program
- CVE-2019-12941 · NVD
- FIRST EPSS
- GHSA-5vr6-c6xh-j699 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences