CVE-2022-24893

ESP-IDF Bluetooth Mesh (ESP-BLE-MESH) contains a memory corruption vulnerability (CVE-2022-24893) triggered during provisioning due to no check on the SegN field of the Transaction Start PDU. This can lead to memory corruption with potential attacker control of the system. Patch commits exist on ...

The vulnerability of the Bluetooth Classic environment for developing IoT applications allows a attacker to execute arbitrary code.

The vulnerability of the Espressif esp-idf software is related to incorrect code generation management. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

idf-personalservice.de Cross Site Scripting vulnerability OBB-2137772

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

CVE-2021-28139

The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly restrict the Feature Page upon reception of an LMP Feature Response Extended packet, allowing attackers in radio range to trigger arbitrary code execution in ESP32 via a crafted Extended Features bitfield...

CVE-2021-28139

The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly restrict the Feature Page upon reception of an LMP Feature Response Extended packet, allowing attackers in radio range to trigger arbitrary code execution in ESP32 via a crafted Extended Features bitfield...

CVE-2021-28139

The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly restrict the Feature Page upon reception of an LMP Feature Response Extended packet, allowing attackers in radio range to trigger arbitrary code execution in ESP32 via a crafted Extended Features bitfield...

Design/Logic Flaw

The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly restrict the Feature Page upon reception of an LMP Feature Response Extended packet, allowing attackers in radio range to trigger arbitrary code execution in ESP32 via a crafted Extended Features bitfield...

CVE-2021-28139

CVE-2021-28139 affects Espressif ESP-IDF 4.4 and earlier. The Bluetooth Classic stack fails to properly restrict the Feature Page on receiving an LMP Feature Response Extended packet, allowing a radio‑range attacker to inject eight bytes of arbitrary data outside the Extended Features Page Table ...

CVE-2021-28136

The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly handle the reception of multiple LMP IO Capability Request packets during the pairing process, allowing attackers in radio range to trigger memory corruption and consequently a crash in ESP32 via a replaye...

CVE-2021-28135

The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly handle the reception of continuous unsolicited LMP responses, allowing attackers in radio range to trigger a denial of service crash in ESP32 by flooding the target device with LMP Feature Response data...

Design/Logic Flaw

The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly handle the reception of continuous unsolicited LMP responses, allowing attackers in radio range to trigger a denial of service crash in ESP32 by flooding the target device with LMP Feature Response data...

Memory corruption

The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly handle the reception of multiple LMP IO Capability Request packets during the pairing process, allowing attackers in radio range to trigger memory corruption and consequently a crash in ESP32 via a replaye...

CVE-2021-28135

CVE-2021-28135 affects Espressif ESP-IDF (Espressif ESP32) Bluetooth Classic stack. The vulnerability is due to improper handling of continuous unsolicited LMP responses, allowing a remote attacker in radio range to cause a denial-of-service (crash) by flooding the device with LMP Feature Respons...

CVE-2021-28135

The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly handle the reception of continuous unsolicited LMP responses, allowing attackers in radio range to trigger a denial of service crash in ESP32 by flooding the target device with LMP Feature Response data...

CVE-2021-28136

The CVE affects Espressif ESP-IDF 4.4 and earlier’s Bluetooth Classic stack. Root cause: ESP32’s handling of multiple LMP IO Capability Request packets during pairing allows a replayed/duplicated LMP packet to trigger memory corruption and a crash. Impact stated in sources: attacker in radio rang...

CVE-2021-28136

The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly handle the reception of multiple LMP IO Capability Request packets during the pairing process, allowing attackers in radio range to trigger memory corruption and consequently a crash in ESP32 via a replaye...

CVE-2020-16146

Espressif ESP-IDF 2.x, 3.0.x through 3.0.9, 3.1.x through 3.1.7, 3.2.x through 3.2.3, 3.3.x through 3.3.2, and 4.0.x through 4.0.1 has a Buffer Overflow in BluFi provisioning in btcblufirecvhandler function in blufiprf.c. An attacker can send a crafted BluFi protocol Write Attribute command to...

CVE-2020-16146

Espressif ESP-IDF 2.x, 3.0.x through 3.0.9, 3.1.x through 3.1.7, 3.2.x through 3.2.3, 3.3.x through 3.3.2, and 4.0.x through 4.0.1 has a Buffer Overflow in BluFi provisioning in btcblufirecvhandler function in blufiprf.c. An attacker can send a crafted BluFi protocol Write Attribute command to...

Buffer overflow

Espressif ESP-IDF 2.x, 3.0.x through 3.0.9, 3.1.x through 3.1.7, 3.2.x through 3.2.3, 3.3.x through 3.3.2, and 4.0.x through 4.0.1 has a Buffer Overflow in BluFi provisioning in btcblufirecvhandler function in blufiprf.c. An attacker can send a crafted BluFi protocol Write Attribute command to...

CVE-2020-16146

ESP-IDF BluFi vulnerability CVE-2020-16146 affects ESP-IDF 2.x, 3.x up to 3.0.9/3.1.7/3.2.3/3.3.2 and 4.0.x up to 4.0.1. A buffer overflow occurs in BluFi provisioning, in btc_blufi_recv_handler (blufi_prf.c). An attacker can send a crafted BluFi protocol Write Attribute command to characteristic...