NetRise Discovers That More Than 80% of Devices Remain Exposed to Pixie Dust a Decade After Disclosure

Austin, TX — September 17, 2025 - NetRise, the company providing visibility into software and firmware supply chain risk, today released its new research report, Legacy Vulnerabilities in Wireless Firmware: The Lingering Threat of the Pixie Dust Exploit. The findings show that Pixie Dust — first disclosed in 2014 — remains exploitable in consumer and SMB networking equipment as of 2025, underscoring pervasive problems in vendor patching, transparency, and firmware supply chains.

The research analyzed firmware from 24 devices across six vendors, including routers, access points, and range extenders, with firmware releases spanning from 2017 through 2025. Despite more than a decade since disclosure, only four of those devices were ever patched, on average, 9.6 years late.

“Pixie Dust is more than a vulnerability. It’s a case study in how insecure defaults and weak patching processes persist in firmware,” said Thomas Pace, co-founder and CEO of NetRise. “Anyone who buys a new product expects it to be secure. This research demonstrates that they’d be wrong. Relying on vendor self-attestation isn’t good enough for enterprises that deploy devices such as these. Creating a comprehensive and accurate SBOM by analyzing the compiled code that’s on the device is the only way to uncover and manage risk.”

Key Findings

• 17% patched: Just 4 of 24 devices known to be vulnerable ever received fixes.
• 9.6 years average lag: Earliest patch delivered 9.0 years after discovery of the vulnerability, latest 10.3 years after.
• Ongoing exposure: 13 actively supported devices remain unpatched; 7 reached end-of-life without fixes.
• Rapid exploitability: Attackers can recover WPS PINs in 1–2 seconds, bypassing password complexity.

Industry Implications

NetRise’s research highlights chronic issues in firmware supply chains. Legacy firmware continues to circulate, leaving networks open to rapid credential compromise. Many vendors provide vague advisories such as “Fixed some security vulnerability,” which conceal the persistence of flaws like Pixie Dust. Worse, insecure defaults are inherited and reintroduced across devices, showing how weaknesses propagate silently through supply chains.

These concerns echo CISA’s recent warning about two actively exploited TP-Link router vulnerabilities (CVE-2023-50224 and CVE-2025-9377). While unrelated to Pixie Dust, the overlap is striking: nearly half of the devices in our sample were TP-Link products, underscoring how central this vendor is to the broader supply chain risk picture.

Recommendations

The report by NetRise highlights immediate steps organizations can take: disable WPS unless explicitly required, generate SBOMs through binary analysis, and audit default configurations. It also calls on vendors to adopt transparent advisories and secure-by-default practices to prevent long-tail exposures like Pixie Dust from persisting.

About the Pixie Dust Exploit

First disclosed in 2014, Pixie Dust exploits weak cryptography in the Wi-Fi Protected Setup (WPS) protocol. Attackers in Wi-Fi range can capture a single handshake and compute the PIN offline in seconds, gaining full network access regardless of password strength.

Download the full report, Legacy Vulnerabilities in Wireless Firmware: The Lingering Threat of the Pixie Dust Exploit, available now from NetRise — with no form fill required.

About NetRise

Based in Austin, Texas, NetRise protects organizations from cybersecurity risk with a revolutionary approach to software supply chain security. By analyzing compiled code rather than source code, its category-redefining platform creates a software asset inventory that identifies risk within the software actually installed on the systems critical to enterprise infrastructure. With NetRise, software producers and device manufacturers alike build a more accurate view of the software composition of their products. Likewise, cybersecurity professionals within the enterprise and federal government can quickly identify vulnerabilities and other software supply chain risks in the assets that run their organization. NetRise provides both groups with the means to respond quickly to threats identified by the NetRise platform. When unforeseen software vulnerabilities are exploited by bad actors, NetRise enables rapid identification, prioritization, mitigation, and policy updates, reducing material risk to the business. https://www.netrise.io/

Media Contact: 

Michelle Kearney
Hi-TouchPR 
Kearney@Hi-TouchPR.com