CyberzSOC

Publication detail
← Back to advisories & guidance

ICSA-24-067-01: Chirp Systems Chirp Access (Update C) ↗ source

March 7, 2024 CISA ICS Advisory
Source: https://www.cisa.gov/news-events/ics-advisories/icsa-24-067-01

Summary

Successful exploitation of this vulnerability could allow an attacker to adjust the Beacon configuration settings and/or disable the Bluetooth functionality of doors where non-networked Beacons are deployed. CVE-2024-2197: The Chirp Access app contains a hard-coded password, BEACON_PASSWORD. An attacker within Bluetooth range could change configuration settings within the Bluetooth beacon, effectively disabling the application's ability to notify users when they are near a Beacon-enabled access point. This variable cannot be used to change the configuration settings of the door readers or locksets and does not affect the ability for authorized users of the mobile application to lock or unlock access points.

Advisory Details CISA ICS CSAF feed

Advisory ID
ICSA-24-067-01
Status
Final · version 4
Initial release
2024-03-07
Last revised
2024-05-02 (4 revisions)
Vendor
Chirp Systems
Critical infrastructure sectors
Commercial Facilities Sector
Deployed
United States
Vendor headquarters
United States

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.

Credit: Matt Brown

Affected products (1)
  • Chirp Access app (Android and iOS) — all versions
Revision history (4)
  • 2024-05-02 — v4: Update C - Risk Evaluation and CVE description updated with clarifying information from Chirp. Link to vendor statement included after changes to statement.
  • 2024-04-25 — v3: Update B - Feedback from Chirp Systems has been integrated in Executive summary, Risk Evaluation, Vulnerability Overview, and Mitigations sections.
  • 2024-04-23 — v2: Update A - Mitigations updated
  • 2024-03-07 — v1: Initial Publication

From CISA's machine-readable CSAF 2.0 advisory (JSON).

Vulnerabilities as Stated by the Advisory

CVEWeaknessCVSS v3Details
CVE-2024-2197 CWE-259 Use of Hard-coded Password 4.3 Medium The Chirp Access app contains a hard-coded password, BEACON_PASSWORD. An attacker within Bluetooth range could change configuration settings within the Bluetooth beacon, effectively disabling the application's ability to notify users when they are near a Beacon-enabled access point. This variable cannot be used to change the configuration settings of the door readers or locksets and does not affect the ability for authorized users of the mobile application to lock or unlock access points.

Mitigation: For additional information, please see Chirp Systems statement here or contact RealPage (Chirp Systems' parent company) via their support page. ↗

Mitigation: For additional information, please see Chirp Systems statement here or contact RealPage (Chirp Systems' parent company) via their support page. ↗

Affected, fixed & timeline

Affected:

  • Chirp Access app (Android and iOS) all versions

Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.

News Coverage

No coverage found in monitored research blogs or news feeds.

CVEs Referenced in This Publication

CVECVSSAffected
CVE-2024-2197 4.3 Medium Chirp Systems Chirp Access The Chirp Access app contains a hard-coded password, BEACON_PASSWORD. An attacker within Bluetooth range could change configuration settings within t…

Named by the advisory itself. Each CVE links to its tracked detail page.

Vendors Named in This Publication

No KEV-catalogued vendors are named in this publication.