JBL Go 2 up to 2021-08-09 LED Glowworm information exposure

Summaryinfo

A vulnerability identified as problematic has been detected in JBL Go 2 up to 2021-08-09. This impacts an unknown function of the component LED Handler. Performing a manipulation results in information exposure. This vulnerability is identified as CVE-2021-38548. The attack may be carried out on the physical device. There is not any exploit available.

Detailsinfo

A vulnerability, which was classified as problematic, was found in JBL Go 2 up to 2021-08-09. This affects some unknown functionality of the component LED Handler. The manipulation with an unknown input leads to a information exposure vulnerability. CWE is classifying the issue as CWE-203. The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not. This is going to have an impact on confidentiality.

The weakness was released 08/12/2021. It is possible to read the advisory at nassiben.com. This vulnerability is uniquely identified as CVE-2021-38548. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1592 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• JBL

Name

• Go 2

Version

• 2021-08-09

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion