CVE-2023-46892
📋 TL;DR
The Meross MSH30Q thermostat's radio frequency communication protocol is vulnerable to replay attacks, allowing attackers to record legitimate commands and replay them to execute unauthorized actions like changing temperature settings. This affects users of the MSH30Q thermostat with vulnerable firmware. Attackers within radio range can exploit this without authentication.
💻 Affected Systems
- Meross MSH30Q Smart Thermostat
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could manipulate thermostat settings to cause physical damage (e.g., extreme temperature changes damaging property), create safety hazards, or disrupt HVAC systems in critical environments.
Likely Case
Unauthorized temperature adjustments causing discomfort, energy waste, or minor property damage in residential settings.
If Mitigated
Limited impact if device is isolated from radio access or patched, though physical proximity attacks remain possible.
🎯 Exploit Status
Exploitation requires physical proximity to capture RF signals. No authentication is needed to replay commands.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not publicly available
Restart Required: No
Instructions:
Check Meross support for firmware updates. If available, update through the Meross app: 1. Open Meross app 2. Select device 3. Check for firmware updates 4. Apply update if available.
🔧 Temporary Workarounds
Physical Isolation
allPlace device in location with limited RF signal access to reduce attack surface.
Network Segmentation
allIsolate thermostat on separate network segment to limit potential lateral movement if compromised.
🧯 If You Can't Patch
- Disable RF communication if possible through device settings
- Monitor for unusual temperature changes and implement physical security controls
🔍 How to Verify
Check if Vulnerable:
Check firmware version in Meross app: Device Settings > About. If version is 4.5.23, device is vulnerable.Check Version:
Not applicable - check through Meross mobile app interfaceVerify Fix Applied:
Verify firmware version has changed from 4.5.23 to a newer version in the Meross app.📡 Detection & Monitoring
Log Indicators:
- Unexpected temperature setting changes in thermostat logs
- Multiple rapid command executions
Network Indicators:
- Unusual RF signal patterns near device (requires specialized RF monitoring equipment)
SIEM Query:
Not applicable - primarily physical/RF based attack