Researchers from mobile security automation firm ZecOps nicknamed the issue "
WiFiDemon." It's also a zero-click vulnerability in that it allows the threat actor to infect a device without requiring any user interaction, although it requires that the setting to
automatically join Wi-Fi networks is enabled (which it is, by default).
"As long as the Wi-Fi is turned on this vulnerability can be triggered," the researchers noted. "If the user is connected to an existing Wi-Fi network, an attacker can launch another attack to disconnect/de-associate the device and then launch this zero-click attack."
"This zero-click vulnerability is powerful: if the malicious access point has password protection and the user never joins the Wi-Fi, nothing will be saved to the disk," the company added. "After turning off the malicious access point, the user's Wi-Fi function will be normal. A user could hardly notice if they have been attacked."
thehackernews.com
