PT-2022-10481 · Unknown · Fastrack Reflex 2.0

Shakir Zari · Published 2022-12-26 · Updated 2023-01-11 · CVE-2021-35954

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions fastrack Reflex 2.0 W307S REFLEX v90.89 Activity Tracker version 90.89

Description The issue allows physically proximate attackers to dump the firmware, flash custom malicious firmware, and brick the device via the Serial Wire Debug (SWD) feature.

Recommendations For fastrack Reflex 2.0 W307S REFLEX v90.89 Activity Tracker version 90.89, as a temporary workaround, consider disabling the Serial Wire Debug (SWD) feature until a patch is available.

Fix

Related Identifiers

CVE-2021-35954

Affected Products

Fastrack Reflex 2.0

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-35954 · Security Note
• https://osv.dev/vulnerability/CVE-2021-35954 · Vendor Advisory
• https://t.me/cvenotify/40695 · Telegram Post
• https://fastrack.in/shop/watch-smart-wearables-reflex-2 · Note
• https://payatu.com/advisory/dumping-and-re-flashing-firmware-fastrack-reflex · Note