Aether-U

15 of 15 entries

ID	Risk	Title	CVSS	CWE
`AETHU-001`	INFO	Ghost Peak Distance Reduction Attack The Ghost Peak attack is a physical-layer distance reduction attack targeting IEEE 802.15.4z HRP UWB ranging. An attacke...	9.2	—
`AETHU-002`	INFO	RTLS Management Console Default Credentials The RTLS management console (Sewio RTLS Studio, Pozyx Creator, or equivalent) is accessible with factory-default credent...	9.8	—
`AETHU-003`	INFO	Unauthenticated MQTT Broker The MQTT broker used by the RTLS platform accepts connections on TCP port 1883 without requiring a username or password,...	8.6	—
`AETHU-004`	INFO	RTLS Position Data Injection via MQTT When the MQTT broker lacks authentication (or when credentials are weak and obtainable), an attacker can publish arbitra...	8.1	—
`AETHU-005`	INFO	SQL Injection in RTLS Reporting Module The RTLS web platform contains SQL injection vulnerabilities in reporting and analytics endpoints where user-supplied pa...	8.5	—
`AETHU-006`	INFO	Unauthenticated RTLS REST API Endpoints Multiple REST API endpoints in the RTLS management platform are accessible without any authentication token or session c...	7.5	—
`AETHU-007`	INFO	UWB STS Key Weakness The Scrambled Timestamp Sequence (STS) used by IEEE 802.15.4z HRP UWB to authenticate ranging frames is derived from a s...	7.8	—
`AETHU-008`	INFO	Cleartext UWB Ranging Exchange UWB ranging frames (Poll, Response, Final) are transmitted in IEEE 802.15.4z SP0 mode without STS or payload encryption,...	6.5	—
`AETHU-009`	INFO	RTLS Anchor Firmware Update Without Signature Verification The RTLS anchor firmware update mechanism accepts firmware images submitted via the management API or a dedicated OTA up...	7.9	—
`AETHU-010`	INFO	MQTT Cleartext Credential Transmission MQTT clients connecting to the RTLS broker transmit credentials (username and password) in cleartext over TCP port 1883 ...	6.8	—
`AETHU-011`	INFO	RTLS Zone Boundary Bypass By combining the Ghost Peak distance reduction technique (AETHU-001) with knowledge of zone boundary geometry extracted ...	7.6	—
`AETHU-012`	INFO	Anchor RF Flooding / Denial of Service The UWB channel used by the RTLS anchors can be saturated with high-rate UWB pulse transmissions from an attacker-contro...	5.8	—
`AETHU-013`	INFO	RTLS Cross-Site Scripting (XSS) in Dashboard The RTLS web dashboard reflects tag label values and custom metadata fields into the HTML page without adequate output e...	6.1	—
`AETHU-014`	INFO	Insecure Direct Object Reference in RTLS API The RTLS REST API uses sequential integer or predictable UUID identifiers for sensor records, tags, and user accounts, a...	6.5	—
`AETHU-015`	INFO	Physical UWB Frame Injection An attacker with physical access to the RF environment and an RF injection-capable device (e.g., a second DWM3000EVB wit...	7.4	—

Detailed View

INFO AETHU-001 — Ghost Peak Distance Reduction Attack

Description: The Ghost Peak attack is a physical-layer distance reduction attack targeting IEEE 802.15.4z HRP UWB ranging. An attacker positioned within RF range injects an early leading pulse into the Two-Way Ranging (TWR) exchange, causing the victim receiver to latch onto the injected pulse rather than the authentic signal, thereby reporting a measured distance significantly shorter than the true physical separation. This attack succeeds without breaking any cryptographic mechanism and was demonstrated to work against DW1000 and DW3000 chip families in published research from 2022. Affected systems include Apple AirTag-like access control implementations, automotive CCC Digital Key systems, and any RTLS deploying HRP UWB without pulse-shape authentication. The consequence is that physical access controls relying on UWB proximity can be bypassed entirely — for example, a vehicle keyless entry system can be unlocked from tens of meters away while the chip reports centimetre-level proximity.

CVSS Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

INFO AETHU-002 — RTLS Management Console Default Credentials

Description: The RTLS management console (Sewio RTLS Studio, Pozyx Creator, or equivalent) is accessible with factory-default credentials such as admin/admin, admin/sewio, or admin/pozyx. Default credentials are frequently left unchanged during deployment as operators rely on network segmentation rather than strong authentication. An unauthenticated remote attacker who can reach the management interface over the network gains full administrative control of the RTLS infrastructure, including the ability to modify anchor configurations, alter zone boundaries, extract all tracked position data, and inject false location records. This vulnerability has a trivially low attack complexity and requires no prior knowledge of the target environment beyond the platform type.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

INFO AETHU-003 — Unauthenticated MQTT Broker

Description: The MQTT broker used by the RTLS platform accepts connections on TCP port 1883 without requiring a username or password, exposing a full publish/subscribe channel to any network-accessible client. Real-time position data for all tracked tags — including tag IDs, X/Y/Z coordinates, zone assignments, velocity vectors, and floor-plan identifiers — is streamed continuously over unauthenticated MQTT topics. An attacker who connects to the broker gains complete visibility into the physical location of every tracked person or asset in real time, enabling surveillance, operational intelligence gathering, and targeted physical attacks. Additionally, unauthenticated write access to the broker allows injection of fabricated position updates that will be consumed by downstream business applications.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

INFO AETHU-004 — RTLS Position Data Injection via MQTT

Description: When the MQTT broker lacks authentication (or when credentials are weak and obtainable), an attacker can publish arbitrary JSON position payloads to RTLS position topics, causing the RTLS engine to process and display fabricated location data as if it originated from legitimate anchors. This allows an attacker to teleport tracked tags to arbitrary zones, trigger false zone-entry or zone-exit alarms, suppress the displayed location of real tags by flooding with conflicting updates, and manipulate safety-critical zone occupancy decisions in industrial or healthcare environments. If the RTLS feeds a physical access control system or a hazardous zone safety interlock, injected positions can result in direct safety consequences.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H

INFO AETHU-005 — SQL Injection in RTLS Reporting Module

Description: The RTLS web platform contains SQL injection vulnerabilities in reporting and analytics endpoints where user-supplied parameters (date ranges, tag IDs, zone names, report filters) are interpolated directly into database queries without parameterisation or sanitisation. An authenticated attacker with low-privilege access to the reporting interface can extract the full database including historical position data, user credentials, API tokens, and configuration secrets via UNION-based or blind SQL injection. In environments where the RTLS database account has file-system privileges, the attacker may read operating system files or write web shells to achieve remote code execution on the database server.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

INFO AETHU-006 — Unauthenticated RTLS REST API Endpoints

Description: Multiple REST API endpoints in the RTLS management platform are accessible without any authentication token or session cookie. Unauthenticated callers can enumerate all anchor hardware configurations (including firmware versions and network addressing), retrieve full tag inventories with their last known positions, and query zone boundary definitions and floor-plan metadata. This information directly enables further attacks by revealing the physical layout of the tracked environment, identifying anchor IPs and firmware versions susceptible to known CVEs, and confirming the topology of the UWB infrastructure prior to a targeted attack.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

INFO AETHU-007 — UWB STS Key Weakness

Description: The Scrambled Timestamp Sequence (STS) used by IEEE 802.15.4z HRP UWB to authenticate ranging frames is derived from a session-level key that may be poorly seeded, statically configured, or exposed via the RTLS management API. When the STS key derivation is weak — for example, using a predictable seed derived from the tag EUI-64 or a static factory-provisioned value — an attacker who captures sufficient ranging exchanges can recover the STS key and forge authenticated ranging responses, making the distance-reduction attack resilient even against platforms that believe STS provides full protection. This finding applies to firmware versions that implement STS key management outside the secure element, or that expose STS configuration parameters over the RTLS API.

CVSS Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

INFO AETHU-008 — Cleartext UWB Ranging Exchange

Description: UWB ranging frames (Poll, Response, Final) are transmitted in IEEE 802.15.4z SP0 mode without STS or payload encryption, making the full ranging exchange observable to any attacker with appropriate RF hardware within range. Captured frames reveal tag and anchor EUI-64 addresses, sequence numbers, timing fields, and any application payload appended to the ranging frame. This exposure enables an attacker to map the UWB topology, identify specific tags of interest (such as those carried by executive personnel or used for vehicle access), build a model of normal ranging behaviour for replay or manipulation attacks, and correlate UWB addresses with physical identity if the RTLS system maps tag IDs to personnel records.

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

INFO AETHU-009 — RTLS Anchor Firmware Update Without Signature Verification

Description: The RTLS anchor firmware update mechanism accepts firmware images submitted via the management API or a dedicated OTA update endpoint without cryptographically verifying the image signature against a vendor-controlled public key. An attacker with network access to the RTLS management interface and low-privilege credentials (or no credentials if the API is unauthenticated) can submit a crafted firmware image to any or all anchors, replacing the legitimate firmware with a malicious version that modifies ranging behaviour, exfiltrates UWB frame data, disrupts positioning, or establishes persistent backdoor access to anchor hardware. Because anchors run continuously and are often physically inaccessible, compromised firmware may persist undetected for extended periods.

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

INFO AETHU-010 — MQTT Cleartext Credential Transmission

Description: MQTT clients connecting to the RTLS broker transmit credentials (username and password) in cleartext over TCP port 1883 without TLS encryption. Any attacker with the ability to perform network interception — via ARP spoofing, a compromised network switch, or proximity to a wireless access point carrying the RTLS traffic — can capture CONNECT packets and extract credentials in plaintext using standard tools such as Wireshark or tshark. Captured credentials can be replayed to gain authenticated access to the MQTT broker, or may be tested against other services if credential reuse is present across the RTLS platform.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

INFO AETHU-011 — RTLS Zone Boundary Bypass

Description: By combining the Ghost Peak distance reduction technique (AETHU-001) with knowledge of zone boundary geometry extracted from the RTLS management API (AETHU-006), an attacker can manipulate the measured distances between a tag and surrounding anchors in a coordinated manner such that the RTLS location engine calculates a tag position inside an authorised zone while the tag carrier is physically located outside of it. This zone spoofing attack allows an attacker to trigger zone-entry events without physical presence in the zone, bypass zone-based access control logic (e.g., automated door unlocking triggered by zone occupancy), and disable zone-exit alerts for personnel who have physically departed a restricted area.

CVSS Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N

INFO AETHU-012 — Anchor RF Flooding / Denial of Service

Description: The UWB channel used by the RTLS anchors can be saturated with high-rate UWB pulse transmissions from an attacker-controlled RF source (e.g., a custom firmware DWM3000EVB or SDR with UWB frontend), preventing legitimate ranging exchanges from completing and causing the RTLS system to lose position data for all tags within the affected coverage area. During a DoS condition the RTLS engine reports tags as lost or stationary at their last known position, which can disable safety alarms, automated zone logic, and personnel tracking. This finding requires physical proximity to the target environment and the use of appropriate RF transmission equipment. NOTE: This test requires explicit dos_authorized=true in the configuration and appropriate RF authorisation from the client.

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

INFO AETHU-013 — RTLS Cross-Site Scripting (XSS) in Dashboard

Description: The RTLS web dashboard reflects tag label values and custom metadata fields into the HTML page without adequate output encoding, enabling stored cross-site scripting attacks. An attacker who can write a tag label (via the management API or by injecting data through the MQTT broker) can insert a malicious script payload that executes in the browser of any RTLS operator who views the dashboard or tag detail page. Successful XSS enables session cookie theft, credential harvesting via overlay login forms, lateral movement to other web applications accessible from the operator's browser, and persistent dashboard manipulation that misleads operators about system state.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

INFO AETHU-014 — Insecure Direct Object Reference in RTLS API

Description: The RTLS REST API uses sequential integer or predictable UUID identifiers for sensor records, tags, and user accounts, and does not enforce ownership or role checks when these identifiers are accessed by authenticated but low-privilege users. An attacker with any valid API credential can iterate over sensor IDs, tag IDs, and user profile IDs to retrieve configuration and location data belonging to other RTLS users or system components. In multi-tenant RTLS deployments this constitutes a cross-tenant data breach; in single-tenant deployments it allows a low-privilege operator to access administrator-level sensor configurations and historical position records without the required privilege level.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

INFO AETHU-015 — Physical UWB Frame Injection

Description: An attacker with physical access to the RF environment and an RF injection-capable device (e.g., a second DWM3000EVB with custom firmware, or a Software Defined Radio with UWB-capable frontend) can transmit forged IEEE 802.15.4z frames that impersonate legitimate anchors, injecting false ranging responses into the Two-Way Ranging exchange. When the RTLS engine processes ranging results that include injected forged anchor responses alongside legitimate ones, the trilateration calculation produces a position estimate displaced from the tag's true location. This attack can be used to systematically move perceived tag positions into or out of authorised zones, generate false alarms, or mask the movement of assets through restricted areas. This finding requires physical_access and injection_authorized to be enabled in the configuration. NOTE: Full execution requires specialised hardware operating under explicit RF testing authorisation.

CVSS Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N