gattacker

Un pacchetto Node.js per Man-in-the-Middle BLE Bluetooth Low Energy e altro. Prerequisiti vedi: https://github.com/sandeepmistry/noble https://github.com/sandeepmistry/bleno Installazione root@kitploit: npm install gattacker Utilizzo Configurazione Per eseguire entrambi i componenti, imposta le...

BLESuite-CLI

BLESuiteCLI README BLESuiteCLI ist ein Kommandozeilen-Tool, das einen einfacheren Weg zum Testen von Bluetooth-Low-Energy-BLE-Geräten ermöglicht. Dieses Tool verwendet die BLESuite-Python-Bibliothek, die pygattlib und den Bluez-Bluetooth-Stack nutzt, wodurch wir BLE-Geräte mithilfe des Generic...

CVE-2026-76640

Unitree G1 EDU firmware through 1.5.2 contains chained vulnerabilities in the BLE GATT server and WiFi provisioning stack that allow an unauthenticated proximate attacker to achieve root code execution (uid 0) without pairing or credentials. The root cause involves an unquoted heredoc variable in...

CVE-2020-14292

CVE-2020-14292: Um problema de transporte Bluetooth no aplicativo COVIDSafe Autor: Alwen Tiu, The Australian National University Última atualização: 2020-09-08 Resumo No aplicativo COVIDSafe até a versão 1.0.21 para Android, o uso inseguro da opção de transporte Bluetooth na conexão GATT permite...

Komfy-Switch-Wifi-Password-Disclosure

Komfy-Switch-Wifi-Password-Disclosure Intro Questa analisi descrive la mia scoperta sul Komfy Switch with Camera di D-Link per recuperare l'SSID e la password WiFi associati al dispositivo via bluetooth 4.0 BLE. Il Komfy switch è un prodotto per la sicurezza domestica e l'automazione che può...

buds-audit

buds-audit Version 1.0.0 Bluetooth-Sicherheitsbewertungstool für drahtlose Ohrhörer, die von der Airoha-SDK-Schwachstellenkette CVE-2025-20700 / CVE-2025-20701 / CVE-2025-20702 betroffen sind. Es scannt nach Geräten in der Nähe, erstellt Fingerabdrücke von bekannten betroffenen Airoha-basierten...

CVE-2026-13213

The Hearing Access Service HAS GATT server in subsys/bluetooth/audio/has.c installs a connection-callback set unconditionally via BTCONNCBDEFINE, so securitychanged runs for every connection that establishes security even before the application has called bthasregister. The service attribute...

CVE-2026-13213

Zephyr RTOS Bluetooth Hearing Access Service (HAS) GATT server (subsys/bluetooth/audio/has.c) contains a NULL-pointer dereference in security_changed(). The connection-callback set is installed unconditionally via BT_CONN_CB_DEFINE, so the callback fires before the application calls bt_has_regist...

CVE-2026-13213 Bluetooth HAS: NULL-pointer dereference DoS when a bonded peer reconnects before bt_has_register

The Hearing Access Service HAS GATT server in subsys/bluetooth/audio/has.c installs a connection-callback set unconditionally via BTCONNCBDEFINE, so securitychanged runs for every connection that establishes security even before the application has called bthasregister. The service attribute...

CVE-2026-13213 Bluetooth HAS: NULL-pointer dereference DoS when a bonded peer reconnects before bt_has_register

The Hearing Access Service HAS GATT server in subsys/bluetooth/audio/has.c installs a connection-callback set unconditionally via BTCONNCBDEFINE, so securitychanged runs for every connection that establishes security even before the application has called bthasregister. The service attribute...

CVE-2026-12236

The Bluetooth host GATT client function parsereadstdchardesc in subsys/bluetooth/host/gatt.c parses an ATT Read By Type Response received from a remote GATT server during BTGATTDISCOVERSTDCHARDESC discovery. The per-entry stride rsp-len is taken directly from the peer's PDU, and the parse loop bo...

CVE-2026-12236 Infinite loop (DoS) in Bluetooth GATT client parsing of Read-By-Type responses with zero data length

The Bluetooth host GATT client function parsereadstdchardesc in subsys/bluetooth/host/gatt.c parses an ATT Read By Type Response received from a remote GATT server during BTGATTDISCOVERSTDCHARDESC discovery. The per-entry stride rsp-len is taken directly from the peer's PDU, and the parse loop bo...

EUVD-2026-58131

The Bluetooth host GATT client function parsereadstdchardesc in subsys/bluetooth/host/gatt.c parses an ATT Read By Type Response received from a remote GATT server during BTGATTDISCOVERSTDCHARDESC discovery. The per-entry stride rsp-len is taken directly from the peer's PDU, and the parse loop bo...

CVE-2026-12236

The CVE concerns the Zephyr Bluetooth host GATT client, where parse_read_std_char_desc() can loop indefinitely if an attacker causes a peer to reply with rsp->len = 0 during BT_GATT_DISCOVER_STD_CHAR_DESC. The loop uses rsp->len to advance the pointer and decrement remaining length, but rsp...

CVE-2026-12236 Infinite loop (DoS) in Bluetooth GATT client parsing of Read-By-Type responses with zero data length

The Bluetooth host GATT client function parsereadstdchardesc in subsys/bluetooth/host/gatt.c parses an ATT Read By Type Response received from a remote GATT server during BTGATTDISCOVERSTDCHARDESC discovery. The per-entry stride rsp-len is taken directly from the peer's PDU, and the parse loop bo...

CVE-2026-10772

DUPLICATE This CVE Record has been rejected by the Zephyr Project CNA. CVE-2026-10772 was assigned to a vulnerability already covered by CVE-2026-2411, which was assigned earlier for the same defect: the Bluetooth GATT notify/indicate paths check the permissions of the Characteristic Declaration...

EUVD-2026-51869

Zephyr's Bluetooth host declares a GATT characteristic as two consecutive attributes: a Characteristic Declaration whose permission is hard-coded to BTGATTPERMREAD, and a Characteristic Value attribute that carries the application-specified security permissions e.g. BTGATTPERMREADENCRYPT /...

CVE-2026-2411 Bluetooth GATT notify/indicate enforces the wrong attribute's permissions, bypassing encryption/authentication requirements on characteristic values

Zephyr's Bluetooth host declares a GATT characteristic as two consecutive attributes: a Characteristic Declaration whose permission is hard-coded to BTGATTPERMREAD, and a Characteristic Value attribute that carries the application-specified security permissions e.g. BTGATTPERMREADENCRYPT /...

CVE-2026-2411

CVE-2026-2411 affects Zephyr’s Bluetooth host GATT: when a Characteristic Declaration is used with a value that requires encryption/authentication, the permission check erroneously evaluated the declaration instead of the value, allowing the Notification/Indicate path to bypass encryption require...

EUVD-2026-51554

The Zephyr Bluetooth GATT client CCC-write response handler gattwritecccrsp in subsys/bluetooth/host/gatt.c invoked the application's params-subscribe callback after it had already called params-notifyconn, params, NULL, 0. Per the public GATT API, a notify callback with NULL data is the document...