According to a Tuesday advisory issued by a US organization called Computer Emergency Readiness Team (US-CERT), there is a security flaw in the Wi-Fi Protected Set-up (WPS) protocol, which is a popular tool packaged into the Wi-Fi routers to facilitate the attachment of additional devices to a secure Wi-Fi network.

Despite the fact that WPS standard is essentially aimed at restricting the number of efforts which may be undertaken by the hackers using a brute force attack hacking mechanism, the US-CERT has pointed out – citing the findings from security researcher Stefan Viehbock – that the current security system returns more-than-required information about the rejected PIN that hackers enter.

As a result, this security hole in the WPS protocol eventually leads to a much weakened PIN.

In an elaboration of the security flaw, the US-CERT said that the design of the WPS protocol is such that it ensures a hassle-free set up WPA encryption-based secure networks using by inexpert home users. The addition of a new device to the secure network requires the users to type in an abridged PIN rather than a long pass-phrase.

The US-CERT advisory about the security flaw comes after the flaw was reported to the organization by Viehbock who said in a blog post that “a few really bad design decisions” enabled “an efficient brute force attack” which can effectively break the security of nearly all WPS-enabled Wi-Fi routers. Viehbock further added that since most of the recent router models are WPS-enabled by default, the security flaw affects “millions of devices worldwide.”