What is CVE-2024-2197?

CVE-2024-2197 is a medium-severity vulnerability in Chirp Systems Access, classified under Use of Hard-coded Password. CVSS score: 4.3/10. Published 2024-03-20.

How severe is CVE-2024-2197?

Medium severity. CVSS v3 base score is 4.3 out of 10.

Is CVE-2024-2197 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Chirp Systems Access

CVE-2024-2197

The Chirp Access app contains a hard-coded password, BEACON_PASSWORD. An attacker within Bluetooth range could change configuration settings within the Bluetooth beacon, effectively disabling the application's ability to notify users when they are near a Beacon-enabled access point. This variable cannot be used to change the configuration settings of the door readers or locksets and does not affect the ability for authorized users of the mobile application to lock or unlock access points.

EPSS: 0.003 (20.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.

Affected products

Chirp Systems Access — versions 0

Weakness classification (CWE)

CWE-259 — Use of Hard-coded Password

Public proof-of-concept exploits

NaInSec/CVE-LIST

References

Frequently asked questions

What is CVE-2024-2197?: CVE-2024-2197 is a medium-severity vulnerability in Chirp Systems Access, classified under Use of Hard-coded Password. CVSS score: 4.3/10. Published 2024-03-20.
How severe is CVE-2024-2197?: Medium severity. CVSS v3 base score is 4.3 out of 10.
Is CVE-2024-2197 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.