CVE-2021-38544: Medium severity Sony Srs-xb33 Firmware vulnerability
Sony SRS-XB33 and SRS-XB43 devices through 2021-08-09 allow remote attackers to recover speech signals from an LED on the device, via a telescope and an electro-optical sensor, aka a "Glowworm" attack. The power indicator LED of the speakers is connected directly to the power line, as a result, the intensity of a device's power indicator LED is correlative to the power consumption. The sound played by the speakers affects their power consumption and as a result is also correlative to the light intensity of the LEDs. By analyzing measurements obtained from an electro-optical sensor directed at the power indicator LEDs of the speakers, we can recover the sound played by them.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-38544?
CVE-2021-38544 is a vulnerability found in Sony SRS-XB33 and SRS-XB43 devices that allows remote attackers to recover speech signals from an LED on the device.
How does the Glowworm attack work?
The Glowworm attack takes advantage of the power indicator LED on Sony SRS-XB33 and SRS-XB43 devices, which is connected directly to the power line, allowing remote attackers to recover speech signals using a telescope and an electro-optical sensor.
Which devices are affected by CVE-2021-38544?
Sony SRS-XB33 and SRS-XB43 devices through the firmware version 2021-08-09 are affected by CVE-2021-38544.
How severe is CVE-2021-38544?
CVE-2021-38544 is considered a medium severity vulnerability with a severity value of 5.9.
Is there a fix available for CVE-2021-38544?
Please refer to the official Sony website or contact Sony support for information on available fixes or firmware updates for CVE-2021-38544.