Wi-Fi Protected Setup (WPS) connects a device to a home network with a push-button or an 8-digit PIN. A design flaw in that PIN cuts a brute-force attack to 11,000 attempts in total, according to CERT/CC. US-CERT warned that freely available attack tools can recover a WPS PIN in 4 to 10 hours. In practice, what is WPS comes down to a shortcut past the Wi-Fi password, with a weak lock on one of its two doors.
Xfinity says newer WiFi products use the feature to eliminate the need to select or enter the network name (SSID) and password. eero and Google leave it out of their routers, citing security, while NETGEAR recommends disabling the PIN because only the PIN connection method is vulnerable to brute force attacks.
Key Takeaways
- CERT/CC found the flaw cuts a full PIN search from 10^8 attempts to 11,000 attempts in total.
- That leaves an attacker about 9,091 times fewer guesses to try.
- US-CERT says freely available tools can recover a WPS PIN in 4 to 10 hours.
- CERT/CC scores the flaw at a CVSS base of 9.3, while NIST’s NVD gives CVE-2011-5053 a base score of 5.8.
- The last digit of the 8-digit PIN is known because it is a checksum.
- Android deprecated WPS in Android 9 and offers Easy Connect from Android 10.
What is WPS on a router?
Wi-Fi Protected Setup has two primary approaches to network setup: push-button and PIN entry. Xfinity says it eliminates the need to select or enter your WiFi information, such as the WiFi Network Name (SSID) and WiFi Network Key (password). Put simply, a device joins without anyone typing the Wi-Fi password.
- Push-button: The router has a physical button, and other devices may have a physical or software-based button.
- PIN entry: A unique PIN is required for each device, either on a fixed label or sticker or generated on a display such as a TV screen.
Per the Wi-Fi Alliance, PIN entry is mandatory in all Wi-Fi Protected Setup devices, while push-button is optional.
What is a WPS used for?
Xfinity says newer WiFi products use it so owners skip entering the network name and password, and a capable product displays a WPS sticker or label. A dynamic PIN can also be shown on a device’s display, such as a TV screen or monitor. The next section walks through both methods step by step.
How the WPS Button and PIN Methods Work
TP-Link tells owners to tap the WPS icon on the device, then press the router’s WPS button for one second within two minutes. Xfinity gives the same two-minute window for pressing the button on its gateways. For the PIN method, TP-Link says the default PIN is an eight-character number printed on the router’s label.
- Button method: Press the router’s button for 1 second within two minutes of starting pairing on the device.
- PIN method: The router’s PIN is enabled by default on TP-Link routers, and owners can use the default one or generate a new one.
The two-minute window: During the two-minute setup period that follows a button press, unintended devices could join the network if they are in range.
TP-Link also warns that holding the WPS button for more than five seconds disables the router’s wireless function.
Why is WPS blinking?
TP-Link says the WPS light blinks when the router enters pairing status. On Xfinity’s XB7 and XB8 gateways, the blue LED light slowly blinks in pairing mode and turns white once pairing is complete. On Xfinity’s Wireless Gateway, the LED blinks for five minutes if the connection is unsuccessful.
Why the WPS PIN Method Is Weak
CERT/CC says a design flaw lets an attacker know when the first half of the 8-digit PIN is correct, and the last digit is known because it is a checksum. The number of attempts goes from 10^8 to 10^4 + 10^3, which is 11,000 attempts in total.
When PIN authentication fails, the access point sends an EAP-NACK message back to the client, and those messages let an attacker determine whether the first half of the PIN is correct. NIST’s description of CVE-2011-5053 says the external registrar method does not properly inform clients about failed PIN authentication. The result is about 9,091 times fewer guesses than a search of the full PIN.
View the data
Brute force shows up throughout the cybersecurity attack data we follow, and this flaw gives it a small search space.
By the numbers: With the flaw, a complete attack on the PIN needs 11,000 attempts in total, and CERT/CC reports that many wireless routers do not implement any kind of lock out policy for brute force attempts. Without a lockout, nothing slows an attacker who stays in range.
How serious is the WPS vulnerability?
US-CERT says most Wi-Fi access points that support Wi-Fi Protected Setup (WPS) are affected, and freely available attack tools can recover a PIN in 4 to 10 hours, per its alert TA12-006A. An attacker within radio range can then obtain WEP or WPA passwords and likely gain access to the Wi-Fi network.
CERT/CC says an attacker within range may be able to retrieve the password for the wireless network, change the configuration of the access point, or cause a denial of service. Radio range also shapes public Wi-Fi security risks: the attacker has to be close, though not inside the home.
| Measure | Scored or reported by | Value |
|---|---|---|
| CVSS v2 base score | CERT/CC | 9.3 |
| CVSS 2.0 base score | NIST NVD | 5.8 |
| Time for free tools to recover a PIN | US-CERT | 4-10 hours |
Source: CERT/CC (revised 2012), NIST NVD, US-CERT
Why it matters: CERT/CC rates the PIN flaw at a CVSS base score of 9.3 with the vector AV:N/AC:M/Au:N/C:C/I:C/A:C, while NIST’s NVD scores CVE-2011-5053 at 5.8 with the vector AV:N/AC:M/Au:N/C:P/I:P/A:N. The two scorers read the impact differently; either number says the PIN deserves attention.
Which Routers Disable or Drop WPS
eero says it does not support Wi-Fi Protected Setup (WPS), as it has well-documented security issues, and Google says the feature is not supported on Google Nest Wifi and Google Wifi for security reasons. NETGEAR routers enter a temporary lockdown after several failed PIN attempts, and NETGEAR recommends disabling the PIN. TP-Link ships the Router’s PIN enabled by default.
| Maker or platform | What its support page says |
|---|---|
| eero | Does not support WPS, citing well-documented security issues |
| Google Nest Wifi and Google Wifi | Not supported, for security reasons |
| NETGEAR | Temporary lockdown after several failed PIN attempts; recommends disabling the PIN |
| TP-Link | Router’s PIN enabled by default |
| Zyxel | Do not use the WPS PIN Configuration method |
| Xfinity gateways | Push Button Configuration and PIN both offered |
| Android phones | Deprecated in Android 9; Easy Connect on Android 10 and higher |
Source: eero, Google, NETGEAR (updated 2025), TP-Link, Zyxel, Xfinity, Android Developers
NETGEAR’s own explainer says many modern routers, including NETGEAR models, have WPS turned off by default. Zyxel says the flaw exists in all WPS-enabled wireless devices.
Does turning WPS off in settings really disable it?
US-CERT warns that some access points may not actually disable WPS when the web management interface indicates that WPS is disabled, and it tells owners to check the access point vendor’s support website for updated firmware. PIN entry is also mandatory in all Wi-Fi Protected Setup devices, while push-button is optional.
NETGEAR exposes the PIN as its own Disable Router’s PIN checkbox, and says the PIN function might temporarily be disabled when the router detects suspicious attempts. TP-Link likewise lists the Router’s PIN under Advanced > Wireless > WPS, apart from the Enable WPS checkbox under System Tools. Using only the button leaves the PIN path in place, so the off switch that matters is the PIN one.
CERT/CC’s workaround is to disable the external registrar feature, which, depending on the vendor, may be labeled as external registrar, router PIN, or WiFi Protected Setup.
How to Turn Off WPS on NETGEAR, TP-Link and Xfinity Routers
On a NETGEAR Nighthawk router, the PIN setting sits under ADVANCED > Advanced Setup > Wireless Settings, while TP-Link puts the switch under System Tools > System Parameters > WPS, where owners check or uncheck the Enable WPS checkbox. Xfinity’s Admin Tool lists the setting under Gateway > Connection > WiFi.
NETGEAR Nighthawk:
- Open a browser on a computer or wireless device connected to the network and go to routerlogin.net.
- Enter the router username and password.
- Select ADVANCED > Advanced Setup > Wireless Settings.
- Tick the box labeled Disable Router’s PIN.
- Save the change with the Apply button.
TP-Link:
- The Router’s PIN appears under Advanced > Wireless > WPS > Router’s PIN.
- To enable or disable WPS, go to System Tools > System Parameters > WPS and check or uncheck the Enable WPS checkbox.
Xfinity: The controls sit on the Admin Tool’s Gateway > Connection > WiFi page, where Xfinity tells owners to make sure WiFi Protected Setup is enabled before pairing. Owners who want it off should look there first, then ask Xfinity support.
It belongs on the same checklist as the other router security settings to change on a new router.
Should you turn WPS off?
NETGEAR recommends disabling the WPS PIN because only the WPS PIN connection method is vulnerable to brute-force attacks, and Zyxel tells users not to use the WPS PIN Configuration method. For most homes, turning the router PIN off helps reduce the risk of a brute-force attack, and turning the whole feature off also removes the button window.
The takeaway: NETGEAR routers lock the PIN after several failed attempts, yet NETGEAR still recommends disabling it, and Zyxel recommends WPA2 encryption with a long password mixing letters and numbers. The PIN’s search space is just 11,000 attempts once the flaw is used.
Once the shortcut is gone, the Wi-Fi password carries the load, which makes the password statistics on weak credentials relevant.
What happens if I turn off WPS on my router?
NETGEAR says owners who need WPS can temporarily enable it, and recommends disabling it again immediately after use. If setup runs only through the router’s app or a QR code, NETGEAR calls disabling WPS the safest option. New devices then join by password or through the maker’s app.
Safer Ways to Connect Devices Without WPS
Android’s developer documentation says devices on Android 10 (API level 29) and higher can use Easy Connect to provision Wi-Fi credentials, as a replacement for WPS, which was deprecated in Android 9.
eero says a printer must support WPA2 AES-based CCMP encryption to connect wirelessly to its network, and TP-Link notes that WPS is not supported on iOS devices. Screenless gadgets remain the holdout, and the spread of smart home devices keeps that gap open.
Conclusion
WPS trades convenience for a PIN that CERT/CC showed can fall in 11,000 attempts, and US-CERT put freely available tools at 4 to 10 hours to recover it. eero and Google leave it out of their systems, while NETGEAR recommends disabling the PIN.
US-CERT’s fixes are to update firmware and, where the access point allows it, to disable WPS. Checking the router PIN setting after that update helps reduce the risk, though no single switch makes a network secure.
