CVE-2024-2104

{
  "id": "CVE-2024-2104",
  "sourceIdentifier": "[email protected]",
  "published": "2025-12-10T13:16:01.987",
  "lastModified": "2026-11-08T20:10:00.187",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Due to improper BLE security configurations on the device's GATT server, an adjacent unauthenticated attacker can read and write device control commands through the mobile app service wich could render the device unusable."
    },
    {
      "lang": "es",
      "value": "Debido a configuraciones de seguridad BLE incorrectas en el servidor GATT del dispositivo, un atacante adyacente no autenticado puede leer y escribir comandos de control del dispositivo a través del servicio de la aplicación móvil, lo que podría dejar el dispositivo inutilizable."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "JBL",
          "product": "LIVE PRO 2 TWS",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "*",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "JBL",
          "product": "TUNE FLEX",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "*",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "ADJACENT_NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-12-10T16:37:02.427390Z",
          "id": "CVE-2024-2104",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-306"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://certvde.com/en/advisories/VDE-2024-076",
      "source": "[email protected]"
    },
    {
      "url": "https://harman.csaf-tp.certvde.com/.well-known/csaf/white/2025/hbsa-2025-0001.json",
      "source": "[email protected]"
    }
  ]
}