CVE-2024-9991: Philips Lighting Information Disclosure

CVE-2024-9991 Overview

CVE-2024-9991 affects Philips lighting devices that store Wi-Fi credentials in plain text within the device firmware. An attacker with physical access can extract the firmware and analyze the binary data to recover the plaintext credentials. Successful exploitation grants unauthorized access to the Wi-Fi network the device is connected to.

The issue is classified under [CWE-312] Cleartext Storage of Sensitive Information. CERT-In tracked the vulnerability in advisory CIVN-2024-0329.

Critical Impact
An attacker with brief physical access to a vulnerable Philips lighting device can extract Wi-Fi credentials from firmware and pivot into the connected wireless network.

Affected Products

Philips lighting devices with firmware storing Wi-Fi credentials in cleartext
Specific model and firmware version list not published in the CERT-In advisory
Refer to the CERT-In Vulnerability Note CIVN-2024-0329 for vendor guidance

Discovery Timeline

2024-10-25 - CVE-2024-9991 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9991

Vulnerability Analysis

The vulnerability resides in how affected Philips lighting devices persist Wi-Fi provisioning data. During onboarding, the device receives the wireless network SSID and pre-shared key, then writes those values to non-volatile firmware storage without encryption or obfuscation.

Because the credentials are stored as cleartext, anyone able to read the firmware image can locate and extract them using standard binary analysis. The exposure is limited to attackers with physical access, but recovery of the credentials yields full network-layer access.

Once inside the wireless network, an attacker can reach any other device on the same segment. That includes IoT hubs, network-attached storage, and management interfaces that trust the local network for authentication.

Root Cause

The root cause is insecure design of the credential storage subsystem. Sensitive provisioning data is written to firmware in cleartext instead of being protected using a hardware-backed keystore, a secure element, or an encrypted partition tied to a device-unique key.

This pattern is common in embedded consumer devices where flash memory contents can be dumped via JTAG, UART, or direct SPI flash reads. No authentication is required to read the flash once the attacker has the physical board.

Attack Vector

Exploitation requires physical possession of the device. An attacker opens the enclosure, connects to the flash chip or a debug interface, and dumps the firmware image. Static analysis of the binary reveals the SSID and Wi-Fi passphrase in plaintext strings.

The attacker then uses the recovered credentials to authenticate to the target wireless network from a nearby location. No interaction with the legitimate owner is required after the device has been accessed.

No public proof-of-concept is available. See the CERT-In Vulnerability Note CIVN-2024-0329 for vendor-supplied technical details.

Detection Methods for CVE-2024-9991

Indicators of Compromise

Unexpected client associations to the wireless network the lighting device is connected to, particularly from unrecognized MAC addresses or device fingerprints
Missing, tampered, or reseated Philips lighting hardware in publicly accessible or semi-public locations
New wireless clients appearing shortly after a lighting device was removed, serviced, or replaced

Detection Strategies

Enable wireless intrusion detection on access points and alert on new or anomalous client joins to networks segmented for IoT devices
Correlate DHCP lease events with an approved inventory of IoT MAC addresses to surface rogue devices
Monitor for lateral movement attempts originating from the IoT VLAN toward corporate resources

Monitoring Recommendations

Ingest access point, DHCP, and RADIUS logs into a centralized data lake for retrospective hunting
Track physical access to areas containing Philips lighting devices using badge or camera logs and correlate with wireless anomalies
Baseline expected IoT device counts per SSID and alert on deviations

How to Mitigate CVE-2024-9991

Immediate Actions Required

Inventory Philips lighting devices deployed in physically accessible locations and prioritize those in public or semi-public areas
Move IoT lighting devices onto a dedicated wireless SSID and VLAN isolated from corporate and sensitive networks
Rotate the Wi-Fi pre-shared key used by the IoT SSID if any device is suspected of tampering, loss, or theft
Review the CERT-In Vulnerability Note CIVN-2024-0329 for vendor updates

Patch Information

No specific vendor patch or fixed firmware version is referenced in the NVD entry or the CERT-In advisory at the time of publication. Contact Philips support and monitor the CERT-In advisory for firmware updates that introduce encrypted credential storage.

Workarounds

Deploy affected devices only inside tamper-evident enclosures or physically secured locations
Segment lighting devices onto an IoT-only SSID with client isolation enabled and no route to sensitive assets
Enforce MAC address filtering and 802.1X where the device supports it to limit reuse of extracted PSKs
Rotate the IoT SSID pre-shared key on a defined schedule and immediately after any device is decommissioned or replaced

bash

# Example: isolate IoT lighting on a dedicated VLAN with client isolation
# (vendor-neutral pseudocode for wireless controller configuration)
ssid create name="IOT-LIGHTING" vlan=42 security=wpa2-psk
ssid set name="IOT-LIGHTING" client-isolation=enable
firewall rule add from=vlan42 to=corp action=deny
firewall rule add from=vlan42 to=internet action=allow