PT-2021-22201 · Creative · Creative Pebble

Ben Nassi + 4 · Published 2021-08-11 · Updated 2021-08-23 · CVE-2021-38546

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions CREATIVE Pebble devices through 2021-08-09

Description The issue allows remote attackers to recover speech signals from an LED on the device via a telescope and an electro-optical sensor, known as a "Glowworm" attack. This is possible because the power indicator LED of the speakers is connected directly to the power line, making the intensity of the device's power indicator LED correlative to the power consumption. The sound played by the speakers affects their power consumption, which is also correlative to the light intensity of the LEDs. By analyzing measurements from an electro-optical sensor directed at the power indicator LEDs, it is possible to recover the sound played by the speakers.

Recommendations For CREATIVE Pebble devices through 2021-08-09, consider disabling the power indicator LED to minimize the risk of exploitation until a patch is available. Restrict access to the device to prevent potential attackers from using a telescope and an electro-optical sensor to capture the LED signals. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2021-38546

Affected Products

Creative Pebble

References · 4

• 🔥 https://nassiben.com/glowworm-attack · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-38546 · Security Note
• https://osv.dev/vulnerability/CVE-2021-38546 · Vendor Advisory
• https://t.me/cibsecurity/27175 · Telegram Post