CVE-2023-23388

이 저장소에는 CVE-2023-23388에 대한 PoC가 포함되어 있으며, 이 취약점은 이 시리즈, 특히 이 게시물에 설명되어 있습니다. Windows 10/11의 블루투스 서비스일명 bthserv에서 발생하는 LPE로, 권한이 없는 사용자가 LOCAL SERVICE로 권한을 상승시킬 수 있습니다. 이 저장소에는 익스플로잇이 아닌 PoC만 포함되어 있습니다. 빌드, 실행 등 VM을 사용하세요. 바이러스일 수 있습니다. MS는 2023년 3월 보안 업데이트에서 이 취약점을 수정했으므로, 해당 업데이트가 적용되지 않은 시스템을...

CVE-2017-0781

CVE-2017-0781 PoC 개요 이것은 Armis가 공개한 Blueborne 백서에 설명된 CVE-2017-0781 Android 힙 오버플로 취약점의 구현입니다. 추가 자료: https://www.armis.com/blueborne/ 현재 상태에서 이 코드는 오버플로와 블루투스 서비스 충돌 유발 능력만을 시연합니다. 다시 말하지만, 이것은 완전히 개발된 원격 코드 실행이 아니지만, 그렇게 될 수 있습니다. 지침 pwntools를 설치하세요. apt-get update apt-get install python2.7...

CVE-2026-96456

The Reachy Mini Bluetooth service asks a connecting device for a PIN before it will accept commands. The check protects the session but not the caller, so an attacker in Bluetooth range can ride along on someone else's successful authentication. The authenticated state is kept in a single shared...

CVE-2026-96456 Reachy Mini Bluetooth PIN authentication can be bypassed by racing an authenticated device

The Reachy Mini Bluetooth service asks a connecting device for a PIN before it will accept commands. The check protects the session but not the caller, so an attacker in Bluetooth range can ride along on someone else's successful authentication. The authenticated state is kept in a single shared...

CVE-2026-96456 Reachy Mini Bluetooth PIN authentication can be bypassed by racing an authenticated device

The Reachy Mini Bluetooth service asks a connecting device for a PIN before it will accept commands. The check protects the session but not the caller, so an attacker in Bluetooth range can ride along on someone else's successful authentication. The authenticated state is kept in a single shared...

EUVD-2026-85186

The Reachy Mini Bluetooth service asks a connecting device for a PIN before it will accept commands. The check protects the session but not the caller, so an attacker in Bluetooth range can ride along on someone else's successful authentication. The authenticated state is kept in a single shared...

CVE-2026-96456

The Reachy Mini robot's Bluetooth service contains a vulnerability where it fails to validate the specific caller of a Bluetooth command. The WriteValue function in src/reachy_mini/daemon/app/services/bluetooth/bluetooth_service.py ignores the device identity passed by BlueZ , instead relying on ...

PT-2026-97279

The Reachy Mini Bluetooth service asks a connecting device for a PIN before it will accept commands. The check protects the session but not the caller, so an attacker in Bluetooth range can ride along on someone else's successful authentication. The authenticated state is kept in a single shared...

CVE-2026-96456: Concurrent Execution using Shared Resource with Improper Synchronization

The Reachy Mini Bluetooth service asks a connecting device for a PIN before it will accept commands. The check protects the session but not the caller, so an attacker in Bluetooth range can ride along on someone else's successful authentication. The authenticated state is kept in a single shared...

CVE-2026-69889

Use after free in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally...

CVE-2026-69448

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally...

CVE-2026-69398

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally...

CVE-2026-69388

Use after free in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally...

CVE-2026-69398

CVE-2026-69398 is a local privilege escalation vulnerability in the Windows Bluetooth Service , caused by a race condition (concurrent execution using a shared resource with improper synchronization). An authorized local attacker with low privileges can exploit this to gain high confidentiality, ...

EUVD-2026-73488

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally...

EUVD-2026-73484

Use after free in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally...

CVE-2026-69388

CVE-2026-69388 is a use-after-free vulnerability in Windows Bluetooth Service that allows a local attacker with low privileges to elevate privileges . The attack requires local access and is characterized by high complexity , with no user interaction needed. The CVSS 3.1 base score is 7.0 (HIGH) ...

EUVD-2026-73046

Use after free in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally...

CVE-2026-69889

CVE-2026-69889 is a use-after-free vulnerability in the Windows Bluetooth Service that allows an authorized attacker to elevate privileges locally . The CVSS v3.1 base score is 7.0 (HIGH) , with a vector of AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H , indicating a local attack requiring low privileges, ...

CVE-2026-69448

CVE-2026-69448 is a local privilege escalation vulnerability in the Windows Bluetooth Service , caused by a race condition due to concurrent execution using a shared resource with improper synchronization. An authorized attacker can exploit this to elevate privileges locally, with a CVSS 3.1 scor...