CVE-2024-25730

The default PSK key is created by concatenating the fixed string 'Hitron' with a 5-digit hexadecimal value. Such construction drastically limits the key space to approximately one million possibilities (CWE-331: insufficient entropy). An attacker, knowing the key generation scheme, can prepare a dictionary in advance or conduct a brute-force attack covering all possible combinations and guess the key in a relatively short time without any user interaction.

An attacker can obtain full unauthorized access to the Wi-Fi network protected by the default PSK key, enabling network traffic interception, access to connected devices, and further actions within the victim's local network.

The default Wi-Fi PSK key must be changed immediately to a strong, randomly generated password of appropriate length and entropy. Apply patches available from the manufacturer according to the references. Until firmware is updated, manual PSK key change through the device's administrative panel is recommended.

Hitron CODA-4582 and CODA-4589 devices using default, factory-set PSK keys (firmware versions indicated in the manufacturer's references).