CVE-2024-40892
Published: 12 August 2024
Summary
CVE-2024-40892 is a high-severity Use of Weak Credentials (CWE-1391) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, ranked in the top 9.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
A weak credential vulnerability affects Firewalla Box Software versions prior to 1.979. The flaw permits use of the device's license UUID to authenticate over the Bluetooth Low-Energy interface and provision SSH credentials, after which an attacker on the local network can log into the SSH service with those credentials. The UUID itself can be obtained by sniffing unencrypted Bluetooth traffic, by reading the QR code printed on the device, or by brute force, though the last method is described as less feasible.
An attacker who is physically close to the device can exploit the issue without prior network access or credentials. After obtaining the UUID and provisioning SSH keys via BTLE, the attacker needs only LAN reachability to establish an SSH session, resulting in high confidentiality, integrity, and availability impact on the affected appliance.
Public advisories recommend upgrading to version 1.979 or later to eliminate the weak credential path over Bluetooth. The referenced analyses from VulnCheck and GreyNoise provide additional technical detail on the Bluetooth provisioning flow and detection opportunities.
EPSS for the CVE rose from a low baseline to a peak of 0.0709, indicating that exploitation interest increased after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-38705
Vulnerability details
A weak credential vulnerability exists in Firewalla Box Software versions before 1.979. This vulnerability allows a physically close attacker to use the license UUID for authentication and provision SSH credentials over the Bluetooth Low-Energy (BTLE) interface. Once an attacker gains…
more
access to the LAN, they could log into the SSH interface using the provisioned credentials. The license UUID can be acquired through plain-text Bluetooth sniffing, reading the QR code on the bottom of the device, or brute-forcing the UUID (though this is less likely).
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.