CVE-2023-24678

Vulnerability

The Centralite Pearl Thermostat running firmware version 0x04075010 is vulnerable to a denial of service (DoS) via a specially crafted Zigbee message. The vulnerability resides in the device's Zigbee stack, which fails to properly handle malformed or malicious messages, leading to a crash or hang. [2]

Exploitation

An attacker within Zigbee radio range can send a crafted Zigbee message to the thermostat. No authentication is required, as the device accepts messages from any Zigbee coordinator or endpoint. The attacker simply transmits the malicious packet, which triggers the vulnerability. [2]

Impact

Successful exploitation results in a denial of service, causing the thermostat to become unresponsive. This prevents normal operation, including temperature control and communication with the home automation system. The device may require a power cycle to recover. [2]

Mitigation

As of the publication date (2023-03-17), no firmware update or patch has been released by Centralite to address this vulnerability. Users are advised to monitor vendor advisories and consider network-level Zigbee filtering or isolation as a temporary workaround. [2]