CVE-2024-40892 describes a weak credential vulnerability in Firewalla Box Software versions prior to 1.979. A physically proximate attacker can exploit this by obtaining the device's license UUID, either via Bluetooth sniffing or reading the QR code, to provision SSH credentials over Bluetooth Low-Energy. This allows the attacker to gain SSH access to the device once on the local network. Rated 7.1 HIGH, the attack requires high attack complexity and user interaction, but grants high confidentiality, integrity, and availability impact. There is currently no public exploit code, active exploitation, or significant community discussion reported for this vulnerability.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| Firewalla | Box Software | >= 0, < 1.979CNA affecteddefault unaffected |
CVSS version used by this source: 3.1
CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.0 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.7 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.