CVE-2024-40893 Firewalla BTLE Authenticated Command Injection
Authenticated attackers near the device can inject OS commands via BTLE network settings, potentially persisting access through cloud sync.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-40893?
CVE-2024-40893 is a medium-severity command injection vulnerability in Firewalla Box Software, published on 12 Aug 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Multiple authenticated operating system (OS) command injection vulnerabilities exist in Firewalla Box Software versions before 1.979. A physically close attacker that is authenticated to the Bluetooth Low-Energy (BTLE) interface can use the network configuration service to inject commands in various configuration parameters including networkConfig.Interface.Phy.Eth0.Extra.PingTestIP, networkConfig.Interface.Phy.Eth0.Extra.DNSTestDomain, and networkConfig.Interface.Phy.Eth0.Gateway6. Additionally, because the configuration can be synced to the Firewalla cloud, the attacker may be able to persist access even after hardware resets and firmware re-flashes.
Weakness: CWE-78
Which versions are affected by CVE-2024-40893?
How do I fix CVE-2024-40893?
No fix has been published for CVE-2024-40893 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2024-40893 being exploited?
There is no known exploitation of CVE-2024-40893 in the wild and no public exploit code.
Sources
Also known as GHSA-f5w2-xh59-w5p8.