Skip to content
OpenAdvisories
Medium ICSA-24-067-01 1 CVE

Chirp Systems Chirp Access (Update C)

Published Mar 7, 2024 · Updated May 2, 2024 · Revision 4

Vendor: Chirp Systems Product: Chirp Access app (Android and iOS)

Summary

Successful exploitation of this vulnerability could allow an attacker to adjust the Beacon configuration settings and/or disable the Bluetooth functionality of doors where non-networked Beacons are deployed.

Vulnerabilities 1

  • Medium 4.3
    CVE-2024-2197

    Chirp Systems Chirp Access Use of Hard-coded Password

    The Chirp Access app contains a hard-coded password, BEACON_PASSWORD. An attacker within Bluetooth range could change configuration settings within the Bluetooth beacon, effectively disabling the application's ability to notify users when they are near a Beac…

    Chirp Systems Chirp Access

Revision history

  1. #4

    Update C - Risk Evaluation and CVE description updated with clarifying information from Chirp. Link to vendor statement included after changes to statement.

  2. #3

    Update B - Feedback from Chirp Systems has been integrated in Executive summary, Risk Evaluation, Vulnerability Overview, and Mitigations sections.

  3. #2

    Update A - Mitigations updated

  4. #1

    Initial Publication

References