CVE-2021-38547

Vulnerability

The Logitech Z120 and S120 speakers (all versions through 2021-08-09) have a design flaw where the power indicator LED is connected directly to the power line. This makes the LED's intensity correlate with the device's power consumption. Since the speakers' power consumption varies with the audio being played, the LED light intensity also carries information about the audio signal [1].

Exploitation

An attacker must have a line-of-sight view of the power indicator LED on the target speakers. They need a telescope to clearly observe the LED from a distance, and an electro-optical sensor (e.g., a photodiode) to capture the LED's light intensity changes over time. The sensor's analog output is digitized and processed to reconstruct the audio waveform. No audio recording equipment or physical access to the device is required [1].

Impact

A remote attacker can recover speech or other sounds played through the speakers, leading to information disclosure of potentially sensitive audio content (e.g., conversations, media). The attack does not require modifying the device and works silently. The recovered signal quality depends on the distance, ambient light conditions, and sensor quality [1].

Mitigation

As of the public disclosure, no firmware or hardware fix has been released by Logitech. The vendor was notified prior to publication, but no patch is available [1]. The only workaround is to physically obscure or disable the power indicator LED (e.g., with opaque tape) to eliminate the optical side channel.