PT-2024-29131 · Unknown · Firewalla Box

Remy · Published 2024-08-12 · Updated 2024-08-21 · CVE-2024-40892

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Firewalla Box Software versions prior to 1.979

Description A weak credential issue exists, allowing a physically close attacker to use the license UUID for authentication and provision SSH credentials over the Bluetooth Low-Energy (BTLE) interface. Once an attacker gains access to the LAN, they could log into the SSH interface using the provisioned credentials. The license UUID can be acquired through plain-text Bluetooth sniffing, reading the QR code on the bottom of the device, or brute-forcing the UUID.

Recommendations For versions prior to 1.979, update to version 1.979 or later to resolve the issue. As a temporary workaround, consider disabling the Bluetooth Low-Energy (BTLE) interface until a patch is available. Restrict access to the SSH interface to minimize the risk of exploitation. Avoid using the provisioned SSH credentials in the affected interface until the issue is resolved.

Exploit

Fix

Weakness Enumeration

CWE-1391

Related Identifiers

CVE-2024-40892

Affected Products

Firewalla Box

References · 11

• 🔥 https://github.com/xen0bit/fwbt · Exploit
• 🔥 https://labs.greynoise.io/grimoire/2024-08-20-bluuid-firewalla · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-40892 · Security Note
• https://t.me/cvenotify/90172 · Telegram Post
• https://twitter.com/_mattata/status/1826323449192874299 · Twitter Post
• https://twitter.com/CVEnew/status/1823067673997254910 · Twitter Post
• https://vulncheck.com/advisories/firewalla-bt-weak-credentials · Note
• https://t.me/cvenotify/90262 · Telegram Post
• https://t.me/cvedetector/2888 · Telegram Post
• https://t.me/cvenotify/91628 · Telegram Post
• https://twitter.com/PorsilapongoCl/status/1823069596108070995 · Twitter Post