Design/Logic Flaw

The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly restrict the Feature Page upon reception of an LMP Feature Response Extended packet, allowing attackers in radio range to trigger arbitrary code execution in ESP32 via a crafted Extended Features bitfield...

CVE-2021-34145

The Bluetooth Classic implementation in the Cypress WICED BT stack through 2.9.0 for CYW20735B1 devices does not properly handle the reception of LMPmaxslot with an invalid Baseband packet type and LTADDRESS and LTADDR after completion of the LMP setup procedure, allowing attackers in radio range...

CVE-2021-34146

The Bluetooth Classic implementation in the Cypress CYW920735Q60EVB does not properly handle the reception of continuous unsolicited LMP responses, allowing attackers in radio range to trigger a denial of service and restart crash of the device by flooding it with LMPAURand packets after the pagi...

CVE-2021-34145

The Bluetooth Classic implementation in the Cypress WICED BT stack through 2.9.0 for CYW20735B1 devices does not properly handle the reception of LMPmaxslot with an invalid Baseband packet type and LTADDRESS and LTADDR after completion of the LMP setup procedure, allowing attackers in radio range...

CVE-2021-31610

The Bluetooth Classic implementation on AB32VG1 devices does not properly handle the reception of continuous unsolicited LMP responses, allowing attackers in radio range to trigger a denial of service either restart or deadlock the device by flooding a device with LMPAUrand data...

Design/Logic Flaw

The Bluetooth Classic implementation on AB32VG1 devices does not properly handle the reception of continuous unsolicited LMP responses, allowing attackers in radio range to trigger a denial of service either restart or deadlock the device by flooding a device with LMPAUrand data...

Information disclosure

The Bluetooth Classic implementation on Zhuhai Jieli AC690X devices does not properly handle the reception of an oversized LMP packet greater than 17 bytes during the LMP auto rate procedure, allowing attackers in radio range to trigger a deadlock via a crafted LMP packet...

Information disclosure

The Bluetooth Classic implementation in the Cypress CYW920735Q60EVB does not properly handle the reception of continuous unsolicited LMP responses, allowing attackers in radio range to trigger a denial of service and restart crash of the device by flooding it with LMPAURand packets after the pagi...

CVE-2021-31612

The Bluetooth Classic implementation on Zhuhai Jieli AC690X devices does not properly handle the reception of an oversized LMP packet greater than 17 bytes during the LMP auto rate procedure, allowing attackers in radio range to trigger a deadlock via a crafted LMP packet...

CVE-2021-31612

CVE-2021-31612 affects Zhuhai Jieli AC690X Bluetooth Classic. The root cause is improper handling of oversized LMP packets (>17 bytes) during the LMP auto-rate procedure, which can cause a deadlock when a crafted LMP packet is received. In security notes from multiple sources (including Red Ha...

CVE-2021-31609

The CVE-2021-31609 issue affects Silicon Labs iWRAP (Bluegiga WT32i module) up to version 6.3.0 and earlier. The vulnerability arises in the Bluetooth Classic LMP handling when receiving an oversized LMP packet (>17 bytes), which can cause a crash in WT32i when a crafted LMP packet is processe...

CVE-2021-28139

CVE-2021-28139 affects Espressif ESP-IDF 4.4 and earlier. The Bluetooth Classic stack fails to properly restrict the Feature Page on receiving an LMP Feature Response Extended packet, allowing a radio‑range attacker to inject eight bytes of arbitrary data outside the Extended Features Page Table ...

CVE-2021-34147

The CVE-2021-34147 entry concerns the Cypress WICED Bluetooth Classic stack (CYW20735B1) up to version 2.9.0. The fault is in handling a malformed LMP timing accuracy response followed by multiple reconnections to the link slave, which can exhaust the device’s Bluetooth resources and lead to a cr...

CVE-2021-34147

The Bluetooth Classic implementation in the Cypress WICED BT stack through 2.9.0 for CYW20735B1 does not properly handle the reception of a malformed LMP timing accuracy response followed by multiple reconnections to the link slave, allowing attackers to exhaust device BT resources and eventually...

CVE-2021-34148

Technical details about CVE-2021-34148 are not publicly available in the provided connected documents. The materials confirm the affected Cypress WICED BT stack (CYW20735B1) and the DoS symptom but provide no concrete root-cause, impact, or fixes here. Monitor for updates.

CVE-2021-34145

The CVE-2021-34145 issue affects Cypress WICED BT Stack (Bluetooth Classic) up to version 2.9.0 for CYW20735B1. The root cause is improper handling of LMP_max_slot when the Baseband packet type is invalid (LT_ADDRESS/LT_ADDR) after LMP setup, which can let attackers within radio range trigger a d...

CVE-2021-34145

The Bluetooth Classic implementation in the Cypress WICED BT stack through 2.9.0 for CYW20735B1 devices does not properly handle the reception of LMPmaxslot with an invalid Baseband packet type and LTADDRESS and LTADDR after completion of the LMP setup procedure, allowing attackers in radio range...

CVE-2021-34143

The CVE-2021-34143 entry affects the Bluetooth Classic implementation in Zhuhai Jieli AC6366C_DEMO_V1.0. The root cause, as described in the connected documents, is improper handling of continuous unsolicited LMP responses, enabling a nearby attacker to flood the device with LMP_AU_Rand packets a...

CVE-2021-34146

The Bluetooth Classic implementation in the Cypress CYW920735Q60EVB does not properly handle the reception of continuous unsolicited LMP responses, allowing attackers in radio range to trigger a denial of service and restart crash of the device by flooding it with LMPAURand packets after the pagi...

CVE-2021-34146

The CVE-2021-34146 entry relates to the Bluetooth Classic implementation in the Cypress CYW920735Q60EVB. The vulnerability stems from improper handling of continuous unsolicited LMP responses, enabling an attacker within radio range to cause a denial of service and device restart by flooding the ...