CVE-2024-40892

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-40892", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2024-07-11T17:35:29.595Z", "datePublished": "2024-08-12T18:32:02.469Z", "dateUpdated": "2024-08-21T17:13:00.297Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Box Software", "vendor": "Firewalla", "versions": [{"lessThan": "1.979", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Matthew \"Remy\" Remacle of GreyNoise"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "A weak credential vulnerability exists in Firewalla Box Software versions before 1.979. This vulnerability allows a physically close attacker to use the license UUID for authentication and provision SSH credentials over the Bluetooth Low-Energy (BTLE) interface. Once an attacker gains access to the LAN, they could log into the SSH interface using the provisioned credentials. The license UUID can be acquired through plain-text Bluetooth sniffing, reading the QR code on the bottom of the device, or brute-forcing the UUID (though this is less likely).<br>"}], "value": "A weak credential vulnerability exists in Firewalla Box Software versions before 1.979. This vulnerability allows a physically close attacker to use the license UUID for authentication and provision SSH credentials over the Bluetooth Low-Energy (BTLE) interface. Once an attacker gains access to the LAN, they could log into the SSH interface using the provisioned credentials. The license UUID can be acquired through plain-text Bluetooth sniffing, reading the QR code on the bottom of the device, or brute-forcing the UUID (though this is less likely)."}], "impacts": [{"capecId": "CAPEC-114", "descriptions": [{"lang": "en", "value": "CAPEC-114 Authentication Abuse"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-1391", "description": "CWE-1391 Use of Weak Credentials", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2024-08-21T17:13:00.297Z"}, "references": [{"tags": ["third-party-advisory"], "url": "https://vulncheck.com/advisories/firewalla-bt-weak-credentials"}, {"tags": ["technical-description", "exploit"], "url": "https://www.labs.greynoise.io/grimoire/2024-08-20-bluuid-firewalla/"}], "source": {"discovery": "EXTERNAL"}, "timeline": [{"lang": "en", "time": "2024-04-11T15:46:00.000Z", "value": "Contact initiated with Firewalla"}, {"lang": "en", "time": "2024-04-12T19:04:00.000Z", "value": "Issues disclosed"}, {"lang": "en", "time": "2024-07-24T04:00:00.000Z", "value": "Firewalla Box version 1.979 released to early access"}, {"lang": "en", "time": "2024-08-12T17:30:00.000Z", "value": "Third-Party advisory published."}], "title": "Firewalla BTLE Weak Credentials", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"affected": [{"vendor": "firewalla", "product": "box_software", "cpes": ["cpe:2.3:a:firewalla:box_software:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "1.979", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-08-12T19:24:41.447719Z", "id": "CVE-2024-40892", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-12T19:26:46.125Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-40892", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-08-12T19:24:41.447719Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:firewalla:box_software:*:*:*:*:*:*:*:*"], "vendor": "firewalla", "product": "box_software", "versions": [{"status": "affected", "version": "0", "lessThan": "1.979", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-12T19:26:14.547Z"}}], "cna": {"title": "Firewalla BTLE Weak Credentials", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Matthew \"Remy\" Remacle of GreyNoise"}], "impacts": [{"capecId": "CAPEC-114", "descriptions": [{"lang": "en", "value": "CAPEC-114 Authentication Abuse"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Firewalla", "product": "Box Software", "versions": [{"status": "affected", "version": "0", "lessThan": "1.979", "versionType": "custom"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2024-04-11T15:46:00.000Z", "value": "Contact initiated with Firewalla"}, {"lang": "en", "time": "2024-04-12T19:04:00.000Z", "value": "Issues disclosed"}, {"lang": "en", "time": "2024-07-24T04:00:00.000Z", "value": "Firewalla Box version 1.979 released to early access"}, {"lang": "en", "time": "2024-08-12T17:30:00.000Z", "value": "Third-Party advisory published."}], "references": [{"url": "https://vulncheck.com/advisories/firewalla-bt-weak-credentials", "tags": ["third-party-advisory"]}, {"url": "https://www.labs.greynoise.io/grimoire/2024-08-20-bluuid-firewalla/", "tags": ["technical-description", "exploit"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "A weak credential vulnerability exists in Firewalla Box Software versions before 1.979. This vulnerability allows a physically close attacker to use the license UUID for authentication and provision SSH credentials over the Bluetooth Low-Energy (BTLE) interface. Once an attacker gains access to the LAN, they could log into the SSH interface using the provisioned credentials. The license UUID can be acquired through plain-text Bluetooth sniffing, reading the QR code on the bottom of the device, or brute-forcing the UUID (though this is less likely).", "supportingMedia": [{"type": "text/html", "value": "A weak credential vulnerability exists in Firewalla Box Software versions before 1.979. This vulnerability allows a physically close attacker to use the license UUID for authentication and provision SSH credentials over the Bluetooth Low-Energy (BTLE) interface. Once an attacker gains access to the LAN, they could log into the SSH interface using the provisioned credentials. The license UUID can be acquired through plain-text Bluetooth sniffing, reading the QR code on the bottom of the device, or brute-forcing the UUID (though this is less likely).<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1391", "description": "CWE-1391 Use of Weak Credentials"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2024-08-21T17:13:00.297Z"}}}, "cveMetadata": {"cveId": "CVE-2024-40892", "state": "PUBLISHED", "dateUpdated": "2024-08-21T17:13:00.297Z", "dateReserved": "2024-07-11T17:35:29.595Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2024-08-12T18:32:02.469Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Box Software", "vendor": "Firewalla", "versions": [{"lessThan": "1.979", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "disclosure@vulncheck.com"}, {"affectedData": [{"cpes": ["cpe:2.3:a:firewalla:box_software:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "box_software", "vendor": "firewalla", "versions": [{"lessThan": "1.979", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A weak credential vulnerability exists in Firewalla Box Software versions before 1.979. This vulnerability allows a physically close attacker to use the license UUID for authentication and provision SSH credentials over the Bluetooth Low-Energy (BTLE) interface. Once an attacker gains access to the LAN, they could log into the SSH interface using the provisioned credentials. The license UUID can be acquired through plain-text Bluetooth sniffing, reading the QR code on the bottom of the device, or brute-forcing the UUID (though this is less likely)."}, {"lang": "es", "value": "Existe una vulnerabilidad de credencial d\u00e9bil en las versiones del software Firewalla Box anteriores a la 1.979. Esta vulnerabilidad permite que un atacante f\u00edsicamente cercano use el UUID de licencia para autenticaci\u00f3n y proporcione credenciales SSH a trav\u00e9s de la interfaz Bluetooth Low-Energy (BTLE). Una vez que un atacante obtiene acceso a la LAN, puede iniciar sesi\u00f3n en la interfaz SSH utilizando las credenciales proporcionadas. El UUID de licencia se puede adquirir mediante el rastreo de texto plano de Bluetooth, la lectura del c\u00f3digo QR en la parte inferior del dispositivo o la fuerza bruta del UUID (aunque esto es menos probable)."}], "id": "CVE-2024-40892", "lastModified": "2026-06-17T07:46:48.347", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-40892", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2024-08-12T19:24:41.447719Z", "version": "2.0.3"}}]}, "published": "2024-08-12T19:15:16.403", "references": [{"source": "disclosure@vulncheck.com", "url": "https://vulncheck.com/advisories/firewalla-bt-weak-credentials"}, {"source": "disclosure@vulncheck.com", "url": "https://www.labs.greynoise.io/grimoire/2024-08-20-bluuid-firewalla/"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1391"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{}