gattacker

BLE ब्लूटूथ लो एनर्जी मैन-इन-द-मिडल और अधिक के लिए एक Node.js पैकेज। पूर्वापेक्षाएँ देखें: https://github.com/sandeepmistry/noble https://github.com/sandeepmistry/bleno स्थापना root@kitploit: npm install gattacker उपयोग कॉन्फ़िगर करें दोनों घटकों को चलाने के लिए config.env में वेरिएबल सेट करें:...

CVE-2020-14292

CVE-2020-14292: COVIDSafe ऐप में ब्लूटूथ ट्रांसपोर्ट समस्या लेखक: अल्वेन तियू, ऑस्ट्रेलियन नेशनल यूनिवर्सिटी अंतिम अद्यतन: 2020-09-08 सारांश COVIDSafe एप्लिकेशन Android के लिए संस्करण 1.0.21 तक में, GATT कनेक्शन में ब्लूटूथ ट्रांसपोर्ट विकल्प के असुरक्षित उपयोग से हमलावर एप्लिकेशन को ब्लूटूथ BR/E...

Komfy-Switch-Wifi-Password-Disclosure

Komfy-Switch-Wifi-Password-Disclosure مقدمة ستفصّل هذه المقالة اكتشافي على مفتاح Komfy مع الكاميرا من D-Link لاسترجاع اسم شبكة الواي فاي وكلمة المرور المرتبطين بالجهاز عبر بلوتوث 4.0 BLE. مفتاح Komfy هو منتج أمني وأتمتة منزلية يمكنه أن يحل محل مفتاح حائط في منزلك لتوفير مراقبة بالفيديو، ومراقبة...

BLESuite-CLI

BLESuiteCLI README BLESuiteCLI est un outil en ligne de commande permettant de tester plus facilement les appareils Bluetooth Low Energy BLE. Cet outil utilise la bibliothèque Python BLESuite, qui s'appuie sur pygattlib et la pile Bluetooth Bluez, ce qui permet de scanner, de lire et d'écrire sur...

buds-audit

buds-audit Version 1.0.0 Outil d'évaluation de sécurité Bluetooth pour les écouteurs sans fil affectés par la chaîne de vulnérabilités du SDK Airoha CVE-2025-20700 / CVE-2025-20701 / CVE-2025-20702. Il scanne les appareils à proximité, identifie les puces Airoha connues comme étant affectées grâc...

CVE-2026-76640

Unitree G1 EDU firmware through 1.5.2 contains multiple chained vulnerabilities in the BLE GATT server and WiFi provisioning stack that allow unauthenticated proximate attackers to achieve root code execution without pairing or credentials by exploiting an unquoted heredoc variable in the WiFi...

CVE-2026-76640

Unitree G1 EDU firmware through 1.5.2 contains chained vulnerabilities in the BLE GATT server and WiFi provisioning stack that allow an unauthenticated proximate attacker to achieve root code execution (uid 0) without pairing or credentials. The root cause involves an unquoted heredoc variable in...

CVE-2026-76640 Unitree G1 EDU 1.5.2 BLE GATT RCE via WiFi Provisioning Stack

Unitree G1 EDU firmware through 1.5.2 contains multiple chained vulnerabilities in the BLE GATT server and WiFi provisioning stack that allow unauthenticated proximate attackers to achieve root code execution without pairing or credentials by exploiting an unquoted heredoc variable in the WiFi...

PT-2026-82733

Name of the Vulnerable Software and Affected Versions Unitree G1 EDU firmware versions prior to 1.5.3 Description Multiple chained issues exist in the BLE GATT server and WiFi provisioning stack. Unauthenticated proximate attackers can achieve root code execution without pairing or credentials...

CVE-2026-13213

The Hearing Access Service HAS GATT server in subsys/bluetooth/audio/has.c installs a connection-callback set unconditionally via BTCONNCBDEFINE, so securitychanged runs for every connection that establishes security even before the application has called bthasregister. The service attribute...

CVE-2026-13213

Zephyr RTOS Bluetooth Hearing Access Service (HAS) GATT server (subsys/bluetooth/audio/has.c) contains a NULL-pointer dereference in security_changed(). The connection-callback set is installed unconditionally via BT_CONN_CB_DEFINE, so the callback fires before the application calls bt_has_regist...

CVE-2026-13213 Bluetooth HAS: NULL-pointer dereference DoS when a bonded peer reconnects before bt_has_register

The Hearing Access Service HAS GATT server in subsys/bluetooth/audio/has.c installs a connection-callback set unconditionally via BTCONNCBDEFINE, so securitychanged runs for every connection that establishes security even before the application has called bthasregister. The service attribute...

CVE-2026-13213 Bluetooth HAS: NULL-pointer dereference DoS when a bonded peer reconnects before bt_has_register

The Hearing Access Service HAS GATT server in subsys/bluetooth/audio/has.c installs a connection-callback set unconditionally via BTCONNCBDEFINE, so securitychanged runs for every connection that establishes security even before the application has called bthasregister. The service attribute...

CVE-2026-12236

The Bluetooth host GATT client function parsereadstdchardesc in subsys/bluetooth/host/gatt.c parses an ATT Read By Type Response received from a remote GATT server during BTGATTDISCOVERSTDCHARDESC discovery. The per-entry stride rsp-len is taken directly from the peer's PDU, and the parse loop bo...

CVE-2026-12236 Infinite loop (DoS) in Bluetooth GATT client parsing of Read-By-Type responses with zero data length

The Bluetooth host GATT client function parsereadstdchardesc in subsys/bluetooth/host/gatt.c parses an ATT Read By Type Response received from a remote GATT server during BTGATTDISCOVERSTDCHARDESC discovery. The per-entry stride rsp-len is taken directly from the peer's PDU, and the parse loop bo...

CVE-2026-12236

The CVE concerns the Zephyr Bluetooth host GATT client, where parse_read_std_char_desc() can loop indefinitely if an attacker causes a peer to reply with rsp->len = 0 during BT_GATT_DISCOVER_STD_CHAR_DESC. The loop uses rsp->len to advance the pointer and decrement remaining length, but rsp...

EUVD-2026-58131

The Bluetooth host GATT client function parsereadstdchardesc in subsys/bluetooth/host/gatt.c parses an ATT Read By Type Response received from a remote GATT server during BTGATTDISCOVERSTDCHARDESC discovery. The per-entry stride rsp-len is taken directly from the peer's PDU, and the parse loop bo...

CVE-2026-12236 Infinite loop (DoS) in Bluetooth GATT client parsing of Read-By-Type responses with zero data length

The Bluetooth host GATT client function parsereadstdchardesc in subsys/bluetooth/host/gatt.c parses an ATT Read By Type Response received from a remote GATT server during BTGATTDISCOVERSTDCHARDESC discovery. The per-entry stride rsp-len is taken directly from the peer's PDU, and the parse loop bo...

PT-2026-71698

Name of the Vulnerable Software and Affected Versions affected versions not specified Description The Bluetooth host GATT client function parse read std char desc in subsys/bluetooth/host/gatt.c fails to validate the minimum value of the per-entry stride rsp-len received from a remote GATT server...

CVE-2026-10772

DUPLICATE This CVE Record has been rejected by the Zephyr Project CNA. CVE-2026-10772 was assigned to a vulnerability already covered by CVE-2026-2411, which was assigned earlier for the same defect: the Bluetooth GATT notify/indicate paths check the permissions of the Characteristic Declaration...