Kr00K: hotel Wi-Fi still leaks guest data (CVE-2019-15126)
The Kr00K flaw lets attackers decrypt Wi-Fi frames after a disconnect on Broadcom and Cypress chips. Patches exist, but hotel fleets remain exposed.
Who is affected
- Wi-Fi devices with Broadcom and Cypress FullMAC chips (BCM43xx, CYW...)
- Consumer-grade access points and routers deployed in rooms and floors
- Connected hotel objects: TVs, locks, thermostats, home automation as Wi-Fi clients
How to fix
Apply firmware updates released by vendors since February 2020; otherwise disable 802.11n mode on unpatched devices, or move sensitive networks to WPA3. For hotels: inventory Wi-Fi equipment by brand and model, check firmware status with the manufacturer or network integrator, isolate the guest network from operational network.
What happened
Kr00K, disclosed by ESET in February 2020, affects Broadcom and Cypress Wi-Fi chips that implement the FullMAC stack, found in a wide variety of access points and client devices. The defect comes from a zeroed encryption key used when handling a disconnection: an attacker within radio range can capture and then decrypt frames exchanged after a disconnect, even under WPA2. In the researchers' tests, roughly one frame in two could be decrypted after exploitation.
The sore point for hospitality is not the flaw itself, which has been documented for years, but the installed base. The affected chips equip many access points installed in rooms and common areas, and many connected hotel objects behave as Wi-Fi clients: a connected TV, a home-automation box, a lock gateway that constantly disconnects and reconnects produces exactly the traffic Kr00K knows how to reread.
Who is affected
- Access points and consumer routers based on Broadcom BCM43xx or Cypress chips, deployed in rooms or floors.
- Hotel Wi-Fi client devices: connected TVs, thermostats, IoT gateways, sensors.
- Guest networks still on WPA2 with equipment whose firmware was never updated.
How to fix
- Inventory Wi-Fi equipment by brand, model and firmware level.
- Apply updates released by manufacturers since February 2020, prioritizing access points in common areas and guest floors.
- For unpatchable devices: disable 802.11n mode, or move the affected network to WPA3 where the hardware allows.
- Separate the guest network from the operational network (PMS, payment, locks): Kr00K does not cross correct segmentation.
- Recommend VPN to guests: end-to-end encrypted traffic stays unreadable even when the radio layer leaks.
Context
Kr00K is a textbook case of hotel security: the flaw has been fixed at most vendors for years, but the installed base does not update itself. A hotel that has not touched its wireless network since 2019 still carries the risk. It is exactly the kind of technical debt a quick audit brings to light, and one an operator can reduce without replacing the infrastructure.