Reaver is a brute-force tool used against Wi-Fi Protected Setup implementations. Attackers use it to recover wireless credentials when WPS is enabled, so defenders should disable WPS where possible, monitor for repeated WPS attempts and ensure access points use stronger authentication settings.
How Reaver Works Against Wi-Fi Protected Setup
Reaver targets the WPS enrolment process rather than the Wi-Fi password itself. When WPS is enabled, the tool sends repeated PIN guesses and uses the router’s response behaviour to narrow the search until it can recover wireless access credentials.
This makes the term important as an attack method, not just a piece of software. The danger is greatest on access points that still expose WPS, because the feature can create a weaker path into a network that may otherwise use stronger wireless authentication.
Why WPS Makes Wireless Networks Easier to Attack
WPS was designed to simplify device onboarding, but that convenience comes with a trust trade-off. If an attacker can interact with the enrolment interface, the security of the wireless network can be reduced to the strength and implementation of the WPS mechanism instead of the main passphrase.
That is why WPS is widely treated as an unnecessary exposure in hardened environments. The issue is not only whether the password is strong, but whether an alternate authentication path exists that can be probed repeatedly.
How Organisations Check Exposure and Reduce It
The first step is to confirm where WPS is actually enabled, which means checking the wireless estate rather than assuming a global policy is in place. In practice, that includes router and access point inventories, configuration reviews, and validation of remote or internet-exposed management surfaces.
Defenders should CIS Benchmarks to harden wireless and network device settings, and use NIST SP 800-53 Rev 5 Security and Privacy Controls to frame configuration management, access control, and auditability for the devices that expose Wi-Fi.
Where possible, the practical remediation is to disable WPS, move to stronger authentication, and ensure the wireless configuration is governed as a security setting rather than a convenience feature. If WPS cannot be removed immediately, reduce exposure by limiting who can reach the management plane and by watching for repeated enrolment attempts.
Detection, Review, and Post-Compromise Response
Repeated WPS attempts are often the clearest signal of active probing, especially when they come in bursts or from unfamiliar devices. Logs from access points, wireless controllers, and adjacent network monitoring tools can show whether the environment is being enumerated or brute-forced.
A useful control lens is to treat the pattern as an authentication-abuse event, then review whether the access point accepted any unexpected enrolments or whether wireless credentials may have been exposed. MITRE ATT&CK Enterprise Matrix is a helpful reference for mapping credential access behaviour to broader intrusion activity, even when the initial abuse starts at the wireless edge.
If exploitation is suspected, defenders should review connected clients, rotate the wireless password if necessary, and verify that no secondary footholds were established through the compromised network segment.
Risk and Threat Considerations
WPS abuse is risky because it creates an alternate path into the network that may be easier to probe than the main Wi-Fi credential. In poorly monitored environments, the attack can blend in as ordinary device setup traffic until access is already recovered.
Failure mechanism: The attacker repeatedly guesses WPS PIN values or abuses weak WPS behaviour until the access point reveals enough information to recover the wireless credential.
Impact: Successful abuse can expose the wireless network, enable unauthorised access, and give an intruder a foothold for broader internal reconnaissance or lateral movement.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-5 — Account Management | Wireless access settings are part of controlling and reviewing network access paths. |
| Recommendation — Harden wireless device settings and review access paths that expose enrolment features. | ||
| NIST SP 800-53 Rev 5 | CM-6 — Configuration Settings | WPS exposure is primarily a device configuration weakness on access points. |
| AC-17 — Remote Access | Wireless exposure creates a remote entry path that must be governed and monitored. | |
| AU-6 — Audit Record Review, Analysis, and Reporting | Repeated WPS attempts are observable events that warrant log review and alerting. | |
| Recommendation — Disable WPS in approved baselines and verify the setting after changes and resets. Restrict and monitor remote wireless administration and enrolment interfaces. Review wireless logs for repeated enrolment attempts and investigate anomalous patterns. | ||
Practitioner Guidance
What to watch for: Treat WPS as a deliberate exposure decision, not a default feature. If the business still depends on it for onboarding, limit its use to tightly controlled cases and review whether that convenience is justified by the resulting attack surface.
Common misunderstanding: A strong Wi-Fi password does not neutralise WPS risk. The two controls are related but not equivalent, and the weaker enrolment path can undermine the stronger one.
Practitioner takeaway: For most environments, the safest posture is to disable WPS, validate that it stays off after firmware changes or resets, and monitor for repeated enrolment attempts.