100 matches found
BlueToolkit
适用于 BR/EDR 和 BLE 的可扩展蓝牙漏洞测试框架。 文档 • 安装 • 使用 • 漏洞利用 • 硬件 • 待办事项 • 汽车评估 • 蓝牙资源 • 许可证 BlueToolkit 是一个模块化的黑盒蓝牙安全测试框架，适用于经典蓝牙（BR/EDR）和低功耗蓝牙（BLE）。它支持半自动化测试，并包含三个主要模块： Recon ：收集蓝牙能力和安全配置。 Exploit ：执行（目前）43 个公开漏洞利用（MitM、RCE、DoS 等）的测试。漏洞模板位于 exploits 文件夹 中。可以通过 TODO 添加更多支持。 Report ：生成结构化的、机器可读且人类可读的 JSON...
knob
README Key Negotiation Of Bluetooth KNOB 攻撃に関するリポジトリ。対象は Bluetooth BR/EDR および Bluetooth Low Energy です。 関連研究 Bluetooth 標準から標準準拠の 0-day 脆弱性へ HWIO20 Bluetooth および Bluetooth Low Energy における鍵ネゴシエーションダウングレード攻撃 TOPS20 Bluetooth の青: KNOB 攻撃の解説 CyberWire19 KNOB は壊れた: Bluetooth BR/EDR...
esp32_bluetooth_classic_sniffer
BrakTooth ESP32 BR/EDR 主动嗅探器/注入器 适用于蓝牙经典的简单“监控模式”。在 ESP32 蓝牙连接中嗅探或注入 BR/EDR 基带数据包。 这是一个逆向工程的 主动 BR/EDR 嗅探器，以及 ESP32 补丁框架，可用于探索 ESP32 控制器与远程目标之间的蓝牙 BT BR/EDR 交互。 与 被动 嗅探器不同，被动嗅探器不与 BT 网络（微微网）交互，而 主动 嗅探器会连接到远程 BT 设备（BR/EDR 目标），并允许在 BT 主机协议栈（如 blue-kitchen ）的指导下，对 BT 协议进行直至基带层的测试。 BrakTooth...
CVE-2026-81508
ESF-IDF is the Espressif Internet of Things IOT Development Framework. In 5.5.5, 6.0.1, and 6.1, the BlueDroid A2DP sink function btca2dpsinkhandleincmedia reads a timestamp field from the received media buffer before validating that the packet layout contains the field. A paired BR/EDR audio...
CVE-2026-81508
The ESF-IDF (Espressif Internet of Things Development Framework) versions 5.5.5 , 6.0.1 , and 6.1 are vulnerable to an out-of-bounds read in the BlueDroid A2DP sink function btc_a2dp_sink_handle_inc_media(). The root cause is that the function reads a timestamp field from a received media buffer ...
CVE-2026-15460
The Bluetooth Classic BR/EDR L2CAP receive handler btl2capbrrecv in subsys/bluetooth/host/classic/l2capbr.c dispatched inbound data PDUs based only on the destination channel ID, without checking that the target channel had reached the BTL2CAPCONNECTED state. A dynamic channel is assigned its RX...
EUVD-2026-75212
The Bluetooth Classic BR/EDR L2CAP receive handler btl2capbrrecv in subsys/bluetooth/host/classic/l2capbr.c dispatched inbound data PDUs based only on the destination channel ID, without checking that the target channel had reached the BTL2CAPCONNECTED state. A dynamic channel is assigned its RX...
CVE-2026-15460 Missing channel-state validation in Zephyr Bluetooth Classic L2CAP receive path
The Bluetooth Classic BR/EDR L2CAP receive handler btl2capbrrecv in subsys/bluetooth/host/classic/l2capbr.c dispatched inbound data PDUs based only on the destination channel ID, without checking that the target channel had reached the BTL2CAPCONNECTED state. A dynamic channel is assigned its RX...
PT-2026-89182
The Bluetooth Classic BR/EDR L2CAP receive handler bt l2cap br recv in subsys/bluetooth/host/classic/l2cap br.c dispatched inbound data PDUs based only on the destination channel ID, without checking that the target channel had reached the BT L2CAP CONNECTED state. A dynamic channel is assigned i...
CVE-2026-85218
A double stack-based buffer overflow was found in the BlueZ AVRCP controller implementation. A nearby BR/EDR peripheral can send a crafted AVRCP player-settings response that supplies an attacker-controlled attribute count, causing avrcplistplayerattributesrsp and avrcpgetcurrentplayervalue in...
SUSE CVE-2026-76922
Bluetooth BR/EDR FHS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service...
EUVD-2026-63157
Bluetooth BR/EDR FHS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service...
Linux Distros Unpatched Vulnerability : CVE-2026-76922
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth BR/EDR FHS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service CVE-2026-76922 Note that Nessus relies on the...
DEBIAN-CVE-2026-76922
Bluetooth BR/EDR FHS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service...
AZL-96836 CVE-2026-76922 affecting package wireshark 4.4.7-2
Bluetooth BR/EDR FHS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service...
CVE-2026-76922
Bluetooth BR/EDR FHS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service...
UBUNTU-CVE-2026-76922
Bluetooth BR/EDR FHS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service...
CVE-2026-76922 NULL Pointer Dereference in Wireshark
Bluetooth BR/EDR FHS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service...
CVE-2026-76922
Wireshark's Bluetooth BR/EDR FHS protocol dissector has a null pointer dereference causing a crash (DoS). Affected versions: 4.4.0–4.4.18 and 4.6.0–4.6.7. CVSS 5.5 (medium). No exploitation details provided. Upgrade to a patched version. See wnpa-sec-2026-80 for details.
