CVE-2021-38548

CVE-2021-38548, dubbed a "Glowworm" attack, affects JBL Go 2 devices by allowing remote attackers to recover speech signals from the device's power indicator LED. This is achieved by observing the LED's light intensity, which correlates with the speaker's power consumption and thus the audio being played. The vulnerability has a CVSS score of 5.9 (Medium), indicating a network-based attack with high confidentiality impact but high attack complexity due to the specialized equipment required. There is no evidence of active exploitation, public exploit code, or significant community discussion, suggesting a low current threat level.