CVE-2021-3774
📋 TL;DR
The Meross Smart Wi-Fi 2 Way Wall Switch (MSS550X) creates an open Wi-Fi access point without encryption during initial setup, allowing remote attackers to intercept Wi-Fi credentials transmitted in plain HTTP/JSON. This affects users of version 3.1.3 and earlier who are configuring the device. Attackers can capture the SSID and password configured through the Meross app.
💻 Affected Systems
- Meross Smart Wi-Fi 2 Way Wall Switch MSS550X
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attacker obtains home/office Wi-Fi credentials, gains network access, and potentially compromises other devices on the network.
Likely Case
Local attacker within Wi-Fi range captures credentials during device setup, gaining unauthorized network access.
If Mitigated
With proper network segmentation and monitoring, impact limited to isolated IoT network segment.
🎯 Exploit Status
Exploitation requires being within Wi-Fi range during setup phase. Attack involves intercepting HTTP/JSON traffic from Meross app to device.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 3.1.3
Vendor Advisory: https://www.incibe.es/en/incibe-cert/notices/aviso/meross-mss550x-missing-encryption-sensitive-data
Restart Required: Yes
Instructions:
1. Open Meross app 2. Check for firmware updates 3. Apply any available updates 4. Reboot device after update
🔧 Temporary Workarounds
Secure setup environment
allConfigure device in physically secure location away from potential attackers
Temporary network isolation
allSet up device on isolated guest network first, then move to main network
🧯 If You Can't Patch
- Replace device with updated model or different vendor
- Place device on isolated IoT VLAN with strict firewall rules
🔍 How to Verify
Check if Vulnerable:
Check device firmware version in Meross app. If version is 3.1.3 or earlier, device is vulnerable during setup.Check Version:
Not applicable - check via Meross mobile app interfaceVerify Fix Applied:
Confirm firmware version is higher than 3.1.3 in Meross app settings.📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP requests to device during setup phase
- Multiple failed connection attempts from unknown devices
Network Indicators:
- Open Wi-Fi AP with Meross/MSS550X in SSID name
- Plain HTTP traffic containing SSID/password fields
SIEM Query:
Not applicable - primarily physical/local network detection