CVE-2021-38547: Medium severity Logitech Z120 Firmware vulnerability
Logitech Z120 and S120 speakers through 2021-08-09 allow remote attackers to recover speech signals from an LED on the device, via a telescope and an electro-optical sensor, aka a "Glowworm" attack. The power indicator LED of the speakers is connected directly to the power line, as a result, the intensity of a device's power indicator LED is correlative to the power consumption. The sound played by the speakers affects their power consumption and as a result is also correlative to the light intensity of the LEDs. By analyzing measurements obtained from an electro-optical sensor directed at the power indicator LEDs of the speakers, we can recover the sound played by them.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-38547?
CVE-2021-38547 has been rated as a medium severity vulnerability due to the potential for remote attackers to recover speech signals.
How do I fix CVE-2021-38547?
To mitigate CVE-2021-38547, users should disconnect the vulnerable Logitech Z120 and S120 speakers, especially models with firmware versions up to inclusive of 2021-08-09.
Which devices are affected by CVE-2021-38547?
CVE-2021-38547 affects Logitech Z120 and S120 speakers with firmware versions up to 2021-08-09.
What kind of attack is described in CVE-2021-38547?
CVE-2021-38547 describes a 'Glowworm' attack where remote attackers can exploit the device's LED to recover audio signals.
Can the hardware of the Logitech Z120 and S120 be secured against CVE-2021-38547?
No, the hardware design itself makes the Logitech Z120 and S120 vulnerable to CVE-2021-38547, and software updates cannot resolve the underlying issue.