CVE Vulnerability

CVE-2021-28139

The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly restrict the Feature Page upon reception of an LMP Feature Response Extended packet, allowing attackers in radio range to trigger arbitrary code execution in ESP32 via a crafted Extended Features bitfield payload.

8.3 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 6.5 / Impact : 10

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

Scope

8.8 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/espressif/esp32-bt-lib Product Third Party Advisory
https://dl.packetstormsecurity.net/papers/general/braktooth.pdf Technical Description Third Party Advisory
https://www.espressif.com/en/products/socs/esp32 Product Vendor Advisory
https://github.com/espressif/esp-idf Product Third Party Advisory
Configurations

Configuration 1
Information

Published : 2021-09-07 07:15

Updated : 2021-09-09 11:30

NVD link : CVE-2021-28139

Mitre link : CVE-2021-28139

Products Affected
No products.
CWE
NVD-CWE-noinfo