CVE-2022-31462: Owl Labs Meeting Owl Use of Hard-coded Credentials Vulnerability
First published: Thu Jun 02 2022(Updated: )
Owl Labs Meeting Owl contains a use of hard-coded credentials vulnerability that allows an attacker to control the device via a backdoor password (derived from the serial number) that can be found in Bluetooth broadcast data.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Owl Labs Meeting Owl | ||
| Owllabs Meeting Owl Pro Firmware | <5.4.2.3 | |
| Owllabs Meeting Owl Pro Firmware |
Remedy
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for the Owl Labs Meeting Owl use of hard-coded credentials vulnerability?
The vulnerability ID for the Owl Labs Meeting Owl use of hard-coded credentials vulnerability is CVE-2022-31462.
What is the impact of the Owl Labs Meeting Owl use of hard-coded credentials vulnerability?
The vulnerability allows an attacker to control the device via a backdoor password derived from the serial number, which is found in Bluetooth broadcast data.
How can an attacker exploit the Owl Labs Meeting Owl use of hard-coded credentials vulnerability?
An attacker can exploit the vulnerability by using the backdoor password derived from the serial number to gain unauthorized control over the device.
Is there a fix for the Owl Labs Meeting Owl use of hard-coded credentials vulnerability?
Yes, a fix for the vulnerability should be provided by Owl Labs. Please refer to the vendor's official update for more information.
Where can I find more information about the Owl Labs Meeting Owl use of hard-coded credentials vulnerability?
You can find more information about the vulnerability in the official update provided by Owl Labs.
- exploited/true
- collector/cisa-known-exploited
- agent/type
- agent/description
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/last-modified-date
- agent/references
- agent/severity
- agent/remedy
- agent/author
- agent/title
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/owl labs
- canonical/owl labs meeting owl
- vendor/owllabs
- canonical/owllabs meeting owl pro firmware