CVE-2021-38545, dubbed "Glowworm," affects Raspberry Pi 3 B+, 3 B+ firmware, 4 B, and 4 B firmware devices. This vulnerability allows remote attackers to recover speech signals from an LED on the device by observing its power indicator LED with a telescope and electro-optical sensor, specifically when the Raspberry Pi powers audio-output equipment. Rated Medium severity (CVSS 5.9), it has a network attack vector and high confidentiality impact, but requires high attack complexity due to the specialized equipment and specific use case. There is no evidence of active exploitation, publicly available exploit code, or significant community discussion, suggesting a low current threat level.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 2021-08-09CPE matchmatch criteria | cpe:2.3:o:raspberrypi:raspberry_pi_4_model_b_firmware:*:*:*:*:*:*:*:* | ||
<= 2021-08-09CPE matchmatch criteria | cpe:2.3:o:raspberrypi:raspberry_pi_3_model_b\+_firmware:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.