PT-2024-19129 · Unknown · Chirp Access

Matt Brown · Published 2024-03-07 · Updated 2024-06-05 · CVE-2024-2197

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Chirp Access (affected versions not specified)

Description The Chirp Access app contains a hard-coded password, BEACON PASSWORD. An attacker within Bluetooth range could change configuration settings within the Bluetooth beacon, effectively disabling the application's ability to notify users when they are near a Beacon-enabled access point. This issue does not affect the ability for authorized users of the mobile application to lock or unlock access points. The app improperly stores credentials within its source code, potentially exposing sensitive information to unauthorized access.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-259

Related Identifiers

CVE-2024-2197

Affected Products

Chirp Access

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-2197 · Security Note
• https://cisa.gov/news-events/ics-advisories/icsa-24-067-01 · Note
• https://statement.chirpsystems.com/chirp-systems-icsa-24-067-01-response.html · Note
• https://twitter.com/cracbot/status/1770899578918748377 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1765828895733903491 · Twitter Post
• https://twitter.com/CVEnew/status/1770236993818984603 · Twitter Post
• https://t.me/cvenotify/82129 · Telegram Post