CVE-2021-38549 Information

Description

MIRACASE MHUB500 USB splitters through 2021-08-09 in certain specific use cases in which the device supplies power to audio-output equipment allow remote attackers to recover speech signals from an LED on the device via a telescope and an electro-optical sensor aka a \Glowworm\ attack. We assume that the USB splitter supplies power to some speakers. The power indicator LED of the USB splitter is connected directly to the power line as a result the intensity of the USB splitter’s power indicator LED is correlative to its power consumption. The sound played by the connected speakers affects the USB splitter’s power consumption and as a result is also correlative to the light intensity of the LED. By analyzing measurements obtained from an electro-optical sensor directed at the power indicator LED of the USB splitter we can recover the sound played by the connected speakers.

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Reference

https://www.nassiben.com/glowworm-attack

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction Required

NONE

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

HIGH

Availability Impact

NONE

Base Score

NONE

Base Severity

5.9