PT-2021-22204 · Miracase · Miracase Mhub500

Ben Nassi + 4 · Published 2021-08-11 · Updated 2021-08-20 · CVE-2021-38549

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions MIRACASE MHUB500 USB splitters through 2021-08-09

Description The issue allows remote attackers to recover speech signals from an LED on the device via a telescope and an electro-optical sensor, also known as a "Glowworm" attack. This occurs when the device supplies power to audio-output equipment. The power indicator LED's intensity is correlative to the device's power consumption, which is affected by the sound played by connected speakers. By analyzing measurements from an electro-optical sensor directed at the power indicator LED, it is possible to recover the sound played by the connected speakers.

Recommendations For MIRACASE MHUB500 USB splitters through 2021-08-09, consider disabling the power indicator LED or restricting the use of the USB splitter to minimize the risk of exploitation until a fix is available. Avoid using the USB splitter to supply power to audio-output equipment that may handle sensitive information. As a temporary workaround, use an alternative power source for audio-output equipment to prevent the correlation between power consumption and sound output. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2021-38549

Affected Products

Miracase Mhub500

References · 4

• 🔥 https://nassiben.com/glowworm-attack · Exploit
• https://osv.dev/vulnerability/CVE-2021-38549 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-38549 · Security Note
• https://t.me/cibsecurity/27167 · Telegram Post