The ADB (formerly Pirelli Broadband Solutions) P.DGA4001N router with firmware PDG_TEF_SP_4.06L.6, and possibly other routers, uses “1236790” and the MAC address to generate the WPA key.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0558
Reference (s):
- http://packetstormsecurity.com/files/129817/Pirelli-Router-P.DG-A4001N-WPA-Key-Reverse-Engineering.html
- http://www.exploit-db.com/exploits/35721
- https://exchange.xforce.ibmcloud.com/vulnerabilities/99682