CVE-2019-9506

Blutooth BR/EDR specification does not specify sufficient encryption key length and allows an attacker to influence key length negotiation

High · published August 14, 2019

CVSS v3.0
7.6
EPSS
3%
Percentile
85.8
In the wild
Unconfirmed
What it is

The Bluetooth BR/EDR specification up to and including version 5.1 permits sufficiently low encryption key length and does not prevent an attacker from influencing the key length negotiation. This allows practical brute-force attacks (aka "KNOB") that can decrypt traffic and inject arbitrary ciphertext without the victim noticing.

The record
Technical detail
CVSS v3.0
7.6 · HIGH
Vector
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.02691 · 85.8th percentile
Published
2019-08-14T16:27Z
EPSS history
Timeline
  • 14 AUG 16:27Z
    Blutooth BR/EDR specification does not specify sufficient encryption key length and allows an attacker to influence key length negotiation
    cvelistv5