Cyber Resilience

CVE-2024-39081

MediumPublic PoC

Published: 18 September 2024

Published
18 September 2024
Modified
17 March 2025
KEV Added
—
Patch
—
CVSS Score v3.1 4.2 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
EPSS Score 0.0284 86.5th percentile
Risk Priority 10 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-39081 is a medium-severity Authentication Bypass by Capture-replay (CWE-294) vulnerability in Jktyre Smart Tyre Car \& Bike. Its CVSS base score is 4.2 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Network Sniffing (T1040); ranked in the top 13.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

EU & UK References

Vulnerability details

An issue in SMART TYRE CAR & BIKE v4.2.0 allows attackers to perform a man-in-the-middle attack via Bluetooth communications.

CWE(s)
CWE-294

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1040 Network Sniffing Credential Access
Adversaries may passively sniff network traffic to capture information about an environment, including authentication material passed over the network.
attack.mitre.org →
T1557 Adversary-in-the-Middle Credential Access
Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as [Network Sniffing](https://attack.
attack.mitre.org →
T1565.002 Transmitted Data Manipulation Impact
Adversaries may alter data en route to storage or other systems in order to manipulate external outcomes or hide activity, thus threatening the integrity of the data.
attack.mitre.org →
Why these techniques?

The vulnerability allows man-in-the-middle attacks via Bluetooth communications, enabling network sniffing (T1040), adversary-in-the-middle positioning to intercept/control traffic (T1557), and transmitted data manipulation (T1565.002).

Affected Assets

jktyre
smart tyre car \& bike
4.2.0

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

AC-9 Previous Logon Notification
addresses: CWE-294

Allows detection of capture-replay attacks by showing the replayed logon's timestamp as the last logon.

SC-23 Session Authenticity
addresses: CWE-294

Protects against replay of captured session tokens or credentials by requiring authenticated, fresh session channels.

SC-40 Wireless Link Protection
addresses: CWE-294

Wireless link protections commonly incorporate replay protection, reducing the exploitability of capture-replay weaknesses.

SC-45 System Time Synchronization
addresses: CWE-294

Accurate synchronized time enables tight timestamp windows that directly limit capture-replay windows in authentication protocols.

References