« Volver al listado

CVE-2024-9991

Estado: AplazadaAlta (7)—

This vulnerability exists in Philips lighting devices due to storage of Wi-Fi credentials in plain text within the device firmware. An attacker with physical access could exploit this by extracting the firmware and analyzing the binary data to obtain the plaintext Wi-Fi credentials stored on the vulnerable device.

Successful exploitation of this vulnerability could allow an attacker to gain unauthorized access to the Wi-Fi network to which vulnerable device is connected.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Acceso físico (AV:P) requerido para extraer firmware y analizar credenciales Wi-Fi en texto plano (CWE-312), permitiendo acceso a la red sin autorización.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

User TrainingRestrict File and Directory PermissionsPassword PoliciesLimit Hardware InstallationBehavior Prevention on EndpointDisable or Remove Feature or Program

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Philips — Lighting DevicesAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-9991",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-9991",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-10-25T15:06:42.607006Z"
        }
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "vdisclose@cert-in.org.in",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 7,
          "Automatable": "NOT_DEFINED",
          "attackVector": "PHYSICAL",
          "baseSeverity": "HIGH",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "HIGH",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "HIGH",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "LOW",
          "vulnConfidentialityImpact": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "vdisclose@cert-in.org.in",
      "affectedData": [
        {
          "vendor": "Philips Lighting (Signify Innovations India)",
          "product": "Philips Smart Wi-Fi LED Batten 24-Watt",
          "versions": [
            {
              "status": "affected",
              "version": "<1.33.1"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Philips Lighting (Signify Innovations India)",
          "product": "Philips Smart Wi-Fi LED T Beamer 20-Watt",
          "versions": [
            {
              "status": "affected",
              "version": "<1.33.1"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Philips Lighting (Signify Innovations India)",
          "product": "Philips Smart Bulb 9,10,12-Watt",
          "versions": [
            {
              "status": "affected",
              "version": "<1.33.1"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Philips Lighting (Signify Innovations India)",
          "product": "Philips Smart T-Bulb 10,12-Watt",
          "versions": [
            {
              "status": "affected",
              "version": "<1.33.1"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:o:signify_innovations_india:phillips_smart_wi-fi_led_batten_24-watt_firmware:*:*:*:*:*:*:*:*"
          ],
          "vendor": "signify_innovations_india",
          "product": "phillips_smart_wi-fi_led_batten_24-watt_firmware",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "1.33.1",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:o:signify_innovations_india:phillips_smart_t-bulb_12-watt_firmware:*:*:*:*:*:*:*:*"
          ],
          "vendor": "signify_innovations_india",
          "product": "phillips_smart_t-bulb_12-watt_firmware",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "1.33.1",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:o:signify_innovations_india:phillips_smart_t-bulb_10-watt_firmware:*:*:*:*:*:*:*:*"
          ],
          "vendor": "signify_innovations_india",
          "product": "phillips_smart_t-bulb_10-watt_firmware",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "1.33.1",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:o:signify_innovations_india:phillips_smart_bulb_9-watt_firmware:*:*:*:*:*:*:*:*"
          ],
          "vendor": "signify_innovations_india",
          "product": "phillips_smart_bulb_9-watt_firmware",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "1.33.1",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:o:signify_innovations_india:phillips_smart_bulb_10-watt_firmware:*:*:*:*:*:*:*:*"
          ],
          "vendor": "signify_innovations_india",
          "product": "phillips_smart_bulb_10-watt_firmware",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "1.33.1",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:o:signify_innovations_india:phillips_smart_bulb_12-watt_firmware:*:*:*:*:*:*:*:*"
          ],
          "vendor": "signify_innovations_india",
          "product": "phillips_smart_bulb_12-watt_firmware",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "1.33.1",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:o:signify_innovations_india:phillips_smart_wi-fi_led_t_beamer_20-watt_firmware:*:*:*:*:*:*:*:*"
          ],
          "vendor": "signify_innovations_india",
          "product": "phillips_smart_wi-fi_led_t_beamer_20-watt_firmware",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "1.33.1",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-10-25T13:15:18.250",
  "references": [
    {
      "url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0329",
      "source": "vdisclose@cert-in.org.in"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "vdisclose@cert-in.org.in",
      "description": [
        {
          "lang": "en",
          "value": "CWE-312"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "This vulnerability exists in Philips lighting devices due to storage of Wi-Fi credentials in plain text within the device firmware. An attacker with physical access could exploit this by extracting the firmware and analyzing the binary data to obtain the plaintext Wi-Fi credentials stored on the vulnerable device.\n\nSuccessful exploitation of this vulnerability could allow an attacker to gain unauthorized access to the Wi-Fi network to which vulnerable device is connected."
    },
    {
      "lang": "es",
      "value": "Esta vulnerabilidad existe en los dispositivos de iluminación Philips debido al almacenamiento de credenciales de Wi-Fi en texto plano dentro del firmware del dispositivo. Un atacante con acceso físico podría aprovechar esto extrayendo el firmware y analizando los datos binarios para obtener las credenciales de Wi-Fi en texto plano almacenado en el dispositivo vulnerable. La explotación exitosa de esta vulnerabilidad podría permitir a un atacante obtener acceso no autorizado a la red Wi-Fi a la que está conectado el dispositivo vulnerable."
    }
  ],
  "lastModified": "2026-06-17T08:25:39.350",
  "sourceIdentifier": "vdisclose@cert-in.org.in"
}