CVE-2021-38546
5.9 MEDIUMCREATIVE Pebble devices through 2021-08-09 allow remote attackers to recover speech signals from an LED on the device, via a telescope an...
Published: 2021-08-11 · Last updated: 2026-06-17
Severity and scoring
- CVSS
- 5.9 MEDIUM
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
| Vendor | Product |
|---|---|
| creative | pebble_firmware, pebble_plus_firmware, pebble_v2_firmware |
Description
CREATIVE Pebble devices through 2021-08-09 allow remote attackers to recover speech signals from an LED on the device, via a telescope and an electro-optical sensor, aka a "Glowworm" attack. The power indicator LED of the speakers is connected directly to the power line, as a result, the intensity of a device's power indicator LED is correlative to the power consumption. The sound played by the speakers affects their power consumption and as a result is also correlative to the light intensity of the LEDs. By analyzing measurements obtained from an electro-optical sensor directed at the power indicator LEDs of the speakers, we can recover the sound played by them.
Source: NVD
References
- [NVD]https://nvd.nist.gov/vuln/detail/CVE-2021-38546
- [Exploit reference]https://www.nassiben.com/glowworm-attack
- [Exploit reference]https://www.nassiben.com/glowworm-attack