CVE-2021-38544
First published: Wed Aug 11 2021(Updated: )
Sony SRS-XB33 and SRS-XB43 devices through 2021-08-09 allow remote attackers to recover speech signals from an LED on the device, via a telescope and an electro-optical sensor, aka a "Glowworm" attack. The power indicator LED of the speakers is connected directly to the power line, as a result, the intensity of a device's power indicator LED is correlative to the power consumption. The sound played by the speakers affects their power consumption and as a result is also correlative to the light intensity of the LEDs. By analyzing measurements obtained from an electro-optical sensor directed at the power indicator LEDs of the speakers, we can recover the sound played by them.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Sony Srs-xb33 Firmware | <=2021-08-09 | |
| Sony SRS-XB33 | ||
| Sony Srs-xb43 Firmware | <=2021-08-09 | |
| Sony Srs-xb43 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2021-38544?
CVE-2021-38544 is a vulnerability found in Sony SRS-XB33 and SRS-XB43 devices that allows remote attackers to recover speech signals from an LED on the device.
How does the Glowworm attack work?
The Glowworm attack takes advantage of the power indicator LED on Sony SRS-XB33 and SRS-XB43 devices, which is connected directly to the power line, allowing remote attackers to recover speech signals using a telescope and an electro-optical sensor.
Which devices are affected by CVE-2021-38544?
Sony SRS-XB33 and SRS-XB43 devices through the firmware version 2021-08-09 are affected by CVE-2021-38544.
How severe is CVE-2021-38544?
CVE-2021-38544 is considered a medium severity vulnerability with a severity value of 5.9.
Is there a fix available for CVE-2021-38544?
Please refer to the official Sony website or contact Sony support for information on available fixes or firmware updates for CVE-2021-38544.
- collector/nvd-index
- agent/references
- agent/severity
- agent/author
- agent/tags
- agent/description
- agent/type
- agent/event
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- vendor/sony
- canonical/sony srs-xb33 firmware
- version/sony srs-xb33 firmware/2021-08-09
- canonical/sony srs-xb33
- canonical/sony srs-xb43 firmware
- version/sony srs-xb43 firmware/2021-08-09
- canonical/sony srs-xb43