CVE-2021-38546: Medium severity Creative Pebble V3 Firmware vulnerability
CREATIVE Pebble devices through 2021-08-09 allow remote attackers to recover speech signals from an LED on the device, via a telescope and an electro-optical sensor, aka a "Glowworm" attack. The power indicator LED of the speakers is connected directly to the power line, as a result, the intensity of a device's power indicator LED is correlative to the power consumption. The sound played by the speakers affects their power consumption and as a result is also correlative to the light intensity of the LEDs. By analyzing measurements obtained from an electro-optical sensor directed at the power indicator LEDs of the speakers, we can recover the sound played by them.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-38546?
CVE-2021-38546 has been classified as a medium severity vulnerability due to the potential for remote attackers to exploit it.
How do I fix CVE-2021-38546?
To mitigate CVE-2021-38546, users should update their Creative Pebble devices to the latest firmware version released after August 9, 2021.
What are the affected devices for CVE-2021-38546?
CVE-2021-38546 affects Creative Pebble V2, V3, and Pebble Plus devices with firmware versions up to 2021-08-09.
What type of attack is described by CVE-2021-38546?
CVE-2021-38546 describes a type of attack known as a 'Glowworm' attack, which can recover speech signals from the LED of the device.
Can CVE-2021-38546 be exploited remotely?
Yes, CVE-2021-38546 can be exploited remotely using a telescope and an electro-optical sensor.