PT-2024-39988

CVE-2024-9991

Published

2024-10-25

Updated

2025-10-09

Description by

CVSS 4.0

7.0

High

MetricsAV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Philips lighting devices (affected versions not specified)

Description This issue is related to the storage of Wi-Fi credentials in plain text within the device firmware of Philips lighting devices. An attacker with physical access could exploit this by extracting the firmware and analyzing the binary data to obtain the plaintext Wi-Fi credentials stored on the vulnerable device. Successful exploitation could allow an attacker to gain unauthorized access to the Wi-Fi network to which the vulnerable device is connected.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-312: Cleartext Storage of Sensitive Information

Related identifiers