PT-2024-7294 · Fireboltt · Fire-Boltt Artillery Smart Watch

Published 2024-08-24 · Updated 2024-10-10 · CVE-2024-46539

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Fire-Boltt Artillery Smart Watch NJ-R6E-10.3

Description: The issue is related to insecure permissions in the Bluetooth Low Energy (BLE) component, which can be exploited to cause a Denial of Service (DoS). This may allow an attacker to disconnect a user from an application or disclose protected information. The vulnerability is associated with incorrect clearance or release of resources.

Recommendations: For Fire-Boltt Artillery Smart Watch NJ-R6E-10.3, consider disabling the BLE component as a temporary workaround until a patch is available to prevent potential Denial of Service attacks. Restrict access to the BLE functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Improper Resource Release

Weakness Enumeration

CWE-284

CWE-404

Related Identifiers

BDU:2024-08648

CVE-2024-46539

Affected Products

Fire-Boltt Artillery Smart Watch

References · 7

• https://bdu.fstec.ru/vul/2024-08648 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-46539 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-32368 · Security Note
• https://github.com/harishmanam/-Fireboltt-Artillery-Smartwatch/blob/main/FB_Artillerysmart_watch_Security_Assessment_report.pdf · Note
• https://t.me/cvedetector/7396 · Telegram Post
• https://twitter.com/CVEnew/status/1843718376482582782 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1844008293766672894 · Twitter Post