Disabling WPS in the user interface may not truly disable the capability, exposing the device to this attack in some cases. Some of these devices have received firmware updates that allow WPS to be entirely disabled.