Philips Lighting Smart T-Bulb 10 Wi-Fi Network cleartext storage

Summaryinfo

A vulnerability was found in Philips Lighting Smart Wi-Fi LED Batten 24-Watt, Smart Wi-Fi LED T Beamer 20-Watt, Smart Bulb 9-Watt, Smart Bulb 10-Watt, Smart Bulb 12-Watt and Smart T-Bulb 10. It has been classified as problematic. Affected by this vulnerability is an unknown functionality of the component Wi-Fi Network Handler. Performing a manipulation results in cleartext storage. This vulnerability was named CVE-2024-9991. The attack may be carried out on the physical device. There is no available exploit.

Detailsinfo

A vulnerability classified as problematic has been found in Philips Lighting Smart Wi-Fi LED Batten 24-Watt, Smart Wi-Fi LED T Beamer 20-Watt, Smart Bulb 9-Watt, Smart Bulb 10-Watt, Smart Bulb 12-Watt and Smart T-Bulb 10. This affects an unknown code block of the component Wi-Fi Network Handler. The manipulation with an unknown input leads to a cleartext storage vulnerability. CWE is classifying the issue as CWE-312. The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere. This is going to have an impact on confidentiality. The summary by CVE is:

This vulnerability exists in Philips lighting devices due to storage of Wi-Fi credentials in plain text within the device firmware. An attacker with physical access could exploit this by extracting the firmware and analyzing the binary data to obtain the plaintext Wi-Fi credentials stored on the vulnerable device. Successful exploitation of this vulnerability could allow an attacker to gain unauthorized access to the Wi-Fi network to which vulnerable device is connected.

The weakness was presented by Shravan Singh, Amey Chavekar, Vishal Giri and Dr. Faruk Kazi as CIVN-2024-0329. The advisory is shared at cert-in.org.in. This vulnerability is uniquely identified as CVE-2024-9991 since 10/15/2024. The exploitability is told to be easy. An attack has to be approached locally. No form of authentication is needed for exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1555 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Philips Lighting

Name

• Smart Bulb 9-Watt
• Smart Bulb 10-Watt
• Smart Bulb 12-Watt
• Smart T-Bulb 10
• Smart Wi-Fi LED Batten 24-Watt
• Smart Wi-Fi LED T Beamer 20-Watt

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion