CVE-2021-44905
📋 TL;DR
CVE-2021-44905 is an incorrect permissions vulnerability in Fortessa FTBTLD Smart Lock's Bluetooth services that allows remote attackers to disable the lock by changing its name without authentication. This affects Fortessa FTBTLD Smart Lock users with devices operating as of December 13, 2022. The vulnerability enables denial of service against the physical lock mechanism.
💻 Affected Systems
- Fortessa FTBTLD Smart Lock
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An attacker within Bluetooth range could disable the smart lock, preventing legitimate users from unlocking doors and potentially causing physical security breaches or lockouts.
Likely Case
Unauthorized users changing lock names to cause confusion or temporary denial of service, disrupting normal access control operations.
If Mitigated
With proper network segmentation and Bluetooth security controls, impact is limited to local Bluetooth range with no remote internet exploitation possible.
🎯 Exploit Status
Exploitation requires Bluetooth-capable device and knowledge of the vulnerability. Public research demonstrates trivial exploitation via standard Bluetooth tools.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: No vendor advisory found in provided references
Restart Required: No
Instructions:
No official patch available. Contact Fortessa for firmware updates or replacement options.
🔧 Temporary Workarounds
Disable Bluetooth when not in use
allTurn off Bluetooth functionality on the smart lock except during legitimate pairing/configuration operations
Physical access control
allRestrict physical proximity to the lock to prevent unauthorized Bluetooth connections
🧯 If You Can't Patch
- Deploy physical monitoring and surveillance around lock locations to detect unauthorized access attempts
- Implement secondary physical security controls (mechanical locks, access logs) to compensate for smart lock vulnerabilities
🔍 How to Verify
Check if Vulnerable:
Attempt to connect to the lock via Bluetooth and send a lock name change request without authentication using tools like Bluetooth debugging appsCheck Version:
Check device firmware version through manufacturer's mobile app or management interfaceVerify Fix Applied:
Test if unauthenticated lock name changes are rejected after applying any firmware updates📡 Detection & Monitoring
Log Indicators:
- Unexpected Bluetooth connection attempts
- Lock name changes without authorized user activity
Network Indicators:
- Bluetooth pairing requests from unknown MAC addresses
- Bluetooth GATT characteristic writes to device name attribute
SIEM Query:
No standard SIEM query available for Bluetooth-based IoT device attacks🔗 References
- https://ashallen.net/fortessa-ftbtld-smart-lock-allows-unauthorized-users-to-change-the-device-name-hilarity-ensues
- https://online.fliphtml5.com/fbwgm/fome/#p=20
- https://ashallen.net/fortessa-ftbtld-smart-lock-allows-unauthorized-users-to-change-the-device-name-hilarity-ensues
- https://online.fliphtml5.com/fbwgm/fome/#p=20
