PT-2022-20741 · Owl · Owl Labs Meeting Owl

Published 2022-06-02 · Updated 2025-08-28 · CVE-2022-31463

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AC:L/AV:A/A:N/C:H/I:L/PR:N/S:C/UI:N

Name of the Vulnerable Software and Affected Versions Owl Labs Meeting Owl version 5.2.0.15

Description The issue is related to improper authentication. Specifically, Owl Labs Meeting Owl does not require a password for Bluetooth commands because it only uses client-side authentication.

Recommendations For version 5.2.0.15, consider disabling Bluetooth commands until a patch is available to mitigate the risk of exploitation. Restrict access to Bluetooth functionality to minimize the risk of unauthorized access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2022-31463

Affected Products

Owl Labs Meeting Owl

References · 13

• 🔥 https://modzero.com/static/meetingowl/Meeting_Owl_Pro_Security_Disclosure_Report_RELEASE.pdf · Exploit
• https://resources.owllabs.com/blog/owl-labs-update · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-31463 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-31463 · Security Note
• https://arstechnica.com/information-technology/2022/06/vulnerabilities-in-meeting-owl-videoconference-device-imperil-100k-users · Note
• https://twitter.com/foxbook/status/1703902527828418603 · Twitter Post
• https://twitter.com/attritionorg/status/1961156049131467104 · Twitter Post
• https://t.me/cvenotify/31027 · Telegram Post
• https://twitter.com/KevDataBase/status/1703807203327492424 · Twitter Post
• https://twitter.com/synfinner/status/1703856165539512788 · Twitter Post
• https://twitter.com/cisaCatalogBot/status/1703816186457203007 · Twitter Post
• https://t.me/true_secator/3043 · Telegram Post
• https://t.me/cvenotify/31073 · Telegram Post