Skip to content

Latest commit

 

History

History
15 lines (9 loc) · 663 Bytes

README.md

File metadata and controls

15 lines (9 loc) · 663 Bytes
Raw

fwbt

Writeup: https://www.labs.greynoise.io/grimoire/2024-08-20-bluuid-firewalla/

Proof of Concept code for interaction with Firewalla via Bluetooth Low-Energy and exploitation of CVE-2024-40892 / CVE-2024-40893

Without any configuration it will scan for Firewalla's in local proximity and leak the checksum of the License UUID.

If License UUID is obtained, it can be defined at var myLicense = "" in main.go at which point:

  1. A local backup of the device configuration will be made.
  2. If the device configuration is already backed up:
  3. Generate root SSH credentials (CVE-2024-40892)
  4. Exploit 3 command injection vulnerabilites (CVE-2024-40893)