CVE-2021-3789

Vulnerability

An information disclosure vulnerability exists in some Motorola-branded Binatone Hubble Cameras that allows an attacker with physical access to obtain the encryption key used to decrypt firmware update packages. The affected models and firmware versions are not explicitly listed in the available references [1].

Exploitation

An attacker must have physical access to the device. By connecting to exposed debug interfaces or directly reading storage, the attacker can extract the encryption key. No authentication or user interaction is required beyond physical proximity [1].

Impact

Successful exploitation grants the attacker the encryption key for firmware update packages. This enables decryption of firmware, potentially leading to reverse engineering, extraction of proprietary code, or crafting of malicious firmware updates (though additional steps are needed for installation). The impact is information disclosure of sensitive firmware data [1].

Mitigation

No specific fix or patched version has been published in the available references [1]. Users should limit physical access to the cameras and monitor the vendor's security advisory for updates.