CVE-2021-28135

CVE-2021-28135 affects Espressif ESP-IDF (Espressif ESP32) Bluetooth Classic stack. The vulnerability is due to improper handling of continuous unsolicited LMP responses, allowing a remote attacker in radio range to cause a denial-of-service (crash) by flooding the device with LMP Feature Respons...

CVE-2021-28135

The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly handle the reception of continuous unsolicited LMP responses, allowing attackers in radio range to trigger a denial of service crash in ESP32 by flooding the target device with LMP Feature Response data...

CVE-2021-34144

The CVE-2021-34144 entry concerns the Zhuhai Jieli AC6366C Bluetooth Classic implementation (SDK up to 0.9.1). The vulnerability lies in the handling of truncated LMP_SCO_Link_Request packets when no other BT connections are active, due to improper processing in the Bluetooth Classic stack. This ...

CVE-2021-34144

The Bluetooth Classic implementation in the Zhuhai Jieli AC6366C BT SDK through 0.9.1 does not properly handle the reception of truncated LMPSCOLinkRequest packets while no other BT connections are active, allowing attackers in radio range to prevent new BT connections disabling the AB5301A inqui...

CVE-2021-28136

The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly handle the reception of multiple LMP IO Capability Request packets during the pairing process, allowing attackers in radio range to trigger memory corruption and consequently a crash in ESP32 via a replaye...

CVE-2021-28136

The CVE affects Espressif ESP-IDF 4.4 and earlier’s Bluetooth Classic stack. Root cause: ESP32’s handling of multiple LMP IO Capability Request packets during pairing allows a replayed/duplicated LMP packet to trigger memory corruption and a crash. Impact stated in sources: attacker in radio rang...

Tracking People by their MAC Addresses

Yet another article on the privacy risks of static MAC addresses and always-on Bluetooth connections. This one is about wireless headphones. The good news is that product vendors are fixing this: Several of the headphones which could be tracked over time are for sale in electronics stores, but...

Bluetrum AB5301A 缓冲区错误漏洞

The Bluetrum AB5301A is a speaker from Bluetrum's Centric Bluetooth. The Bluetrum AB5301A suffers from a buffer error vulnerability that stems from the Bluetooth Classic implementation on a Bluetrum AB5301A device with an unknown firmware version being unable to correctly handle the reception of...

Zhuhai Jieli AC690X输入验证错误漏洞

The Zhuhai Jieli AC690X is a Bluetooth chip. The Zhuhai Jieli AC690X suffers from an input validation error vulnerability that stems from the Bluetooth Classic implementation on Zhuhai Jieli AC690X and AC692X devices failing to properly handle a garbled LMP setup program followed by a misformatte...

JBL TUNE500BT输入验证错误漏洞

The JBL TUNE500BT is a Bluetooth headset from harman. The JBL TUNE500BT suffers from an input validation error vulnerability that stems from the Bluetooth Classic implementation on the JBL TUNE500BT device failing to properly handle the reception of successive unsolicited LMP responses, allowing ...

Silicon Labs iWRAP 安全漏洞

Silicon Labs iWRAP is silabs' embedded Bluetooth stack for the Bluegiga Legacy Bluetooth Classic module. A security vulnerability exists in Silicon Labs iWRAP that stems from the Bluetooth Classic implementation in Silicon Labs iWRAP 6.3.0 and earlier versions not properly handling the reception ...

AB32VG1 安全漏洞

The AB32VG1 is a chip from ZTE Bluetooth. A security vulnerability exists in the AB32VG1, which stems from the Bluetooth Classic implementation on the AB32VG1 device not properly handling the reception of successive unsolicited LMP responses, allowing an attacker within radio range to trigger a...

Cypress WICED BT 输入验证错误漏洞

Cypress WICED BT is a full-featured platform from cypress. The Cypress WICED BT suffers from an input validation error vulnerability that stems from the Bluetooth Classic implementation in the Cypress WICED BT stack via 2.9.0 for CYW20735B1 not being able to correctly handle the receipt of an...

Zhuhai Jieli AC690X 输入验证错误漏洞

The Zhuhai Jieli AC690X is a Bluetooth chip. The Zhuhai Jieli AC690X suffers from an Input Validation Error vulnerability that stems from the Bluetooth Classic implementation on Zhuhai Jieli AC690X and AC692X devices failing to properly handle a garbled LMP setup program followed by a misformatte...

CYW920735Q60EVB安全漏洞

The CYW920735Q60EVB is Cypress' evaluation and development of Bluetooth applications with the dual-mode Bluetooth 5.0 wireless MCU device CYW20735B1. A security vulnerability exists in the CYW920735Q60EVB that stems from the Bluetooth Classic implementation in the doCypress CYW920735Q60EVB not...

Espressif ESP-IDF缓冲区错误漏洞

Espressif ESP-IDF is an Internet of Things IoT development framework from China's Loxin Information Technology Espressif. A buffer error vulnerability exists in Espressif ESP-IDF that stems from the Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier versions failing to correctl...

Zhuhai Jieli AC6366C 安全漏洞

Zhuhai Jieli AC6366C is a Bluetooth chip from Zhuhai Jieli. A security vulnerability in the Bluetooth Classic implementation of the Zhuhai Jieli AC6366CDEMOV1.0 allows an attacker within radio range to trigger a denial of service on the device by using LMPAURand packets after a paging program...

Cypress WICED BT 输入验证错误漏洞

Cypress WICED BT is a full-featured platform for cypress. The Cypress WICED BT suffers from an input validation error vulnerability that stems from the Bluetooth Classic implementation in the Cypress WICED BT stack up to 2.9.0 for the CYW20735B1 device failing to correctly handle the reception of...

Espressif ESP-IDF 代码注入漏洞

Espressif ESP-IDF is an Internet of Things IoT development framework from China's Loxin Information Technology Espressif. A code injection vulnerability exists in the Espressif ESP-IDF that stems from the Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier versions not properly...

Bluetooth Bugs Open Billions of Devices to DoS, Code Execution

Researchers have disclosed a group of 16 different vulnerabilities collectively dubbed BrakTooth, which impact billions of devices that rely on Bluetooth Classic BT for communication. According to an academic paper from the University of Singapore, the bugs are found in the closed commercial BT...