CVE-2021-31609

The Bluetooth Classic implementation in Silicon Labs iWRAP 6.3.0 and earlier does not properly handle the reception of an oversized LMP packet greater than 17 bytes, allowing attackers in radio range to trigger a crash in WT32i via a crafted LMP packet.

CVSS v3 6.5 MEDIUM
CVSS v2.0 3.3 LOW

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

3.3^/10

CVSS v2.0 : LOW

Vector : AV:A/AC:L/Au:N/C:N/I:N/A:P

Exploitability : 6.5 / Impact : 2.9

Access Vector ADJACENT_NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
https://dl.packetstormsecurity.net/papers/general/braktooth.pdf	Technical Description Third Party Advisory
https://www.silabs.com/wireless/bluetooth/bluegiga-classic-legacy-modules/device.wt32i-a	Product Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:a:silabs:iwrap:*:*:*:*:*:*:*:*

cpe:2.3:h:silabs:wt32i-a:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2021-09-07 07:15

Updated : 2024-02-28 18:28

NVD link : CVE-2021-31609

Mitre link : CVE-2021-31609

CVE.ORG link : CVE-2021-31609

JSON object : View

Products Affected

silabs

iwrap
wt32i-a

CWE

NVD-CWE-noinfo

{"id": "CVE-2021-31609", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.3, "accessVector": "ADJACENT_NETWORK", "vectorString": "AV:A/AC:L/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.5, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2021-09-07T07:15:06.940", "references": [{"url": "https://dl.packetstormsecurity.net/papers/general/braktooth.pdf", "tags": ["Technical Description", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.silabs.com/wireless/bluetooth/bluegiga-classic-legacy-modules/device.wt32i-a", "tags": ["Product", "Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "The Bluetooth Classic implementation in Silicon Labs iWRAP 6.3.0 and earlier does not properly handle the reception of an oversized LMP packet greater than 17 bytes, allowing attackers in radio range to trigger a crash in WT32i via a crafted LMP packet."}, {"lang": "es", "value": "La implementaci\u00f3n de Bluetooth Classic en Silicon Labs iWRAP versiones 6.3.0 y anteriores, no maneja apropiadamente la recepci\u00f3n de un paquete LMP de tama\u00f1o superior a 17 bytes, que permite a atacantes en el rango de radio desencadenar un fallo en WT32i por medio de un paquete LMP dise\u00f1ado"}], "lastModified": "2021-09-20T12:04:53.323", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:silabs:iwrap:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4C0FC507-BF4A-4534-ACA1-F42715ECD6F0", "versionEndIncluding": "6.3.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:silabs:wt32i-a:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "6D8CAA5C-2519-4415-BB6A-802588CE984B"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}