CVE-2021-38548: Medium severity JBL Go 2 Firmware vulnerability
JBL Go 2 devices through 2021-08-09 allow remote attackers to recover speech signals from an LED on the device, via a telescope and an electro-optical sensor, aka a "Glowworm" attack. The power indicator LED of the speakers is connected directly to the power line, as a result, the intensity of a device's power indicator LED is correlative to the power consumption. The sound played by the speakers affects their power consumption and as a result is also correlative to the light intensity of the LEDs. By analyzing measurements obtained from an electro-optical sensor directed at the power indicator LEDs of the speakers, we can recover the sound played by them.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-38548?
CVE-2021-38548 is classified as a high-severity vulnerability due to its potential for exploitation by remote attackers.
How do I fix CVE-2021-38548?
To mitigate CVE-2021-38548, users should update their JBL Go 2 devices to the latest firmware released after August 9, 2021.
What does CVE-2021-38548 allow attackers to do?
CVE-2021-38548 allows remote attackers to recover speech signals from the JBL Go 2 device's LED using a telescope and an electro-optical sensor.
Which devices are affected by CVE-2021-38548?
CVE-2021-38548 affects JBL Go 2 devices with firmware versions prior to the update released on August 9, 2021.
Is the JBL Go 2 hardware itself vulnerable in CVE-2021-38548?
No, the JBL Go 2 hardware is not inherently vulnerable; the issue lies within the firmware versions up to August 9, 2021.