CVE-2024-1638CWE-20

Bluetooth characteristic LESC security requirement not enforced without additional flags

High · published February 19, 2024

CVSS v3.1
8.2
EPSS
0%
Percentile
27.4
In the wild
Unconfirmed
What it is

The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characteristic: Attribute read/write permission with LE Secure Connection encryption. If set, requires that LE Secure Connections is used for read/write access, however this is only true when it is combined with other permissions, namely BT_GATT_PERM_READ_ENCRYPT/BT_GATT_PERM_READ_AUTHEN (for read) or BT_GATT_PERM_WRITE_ENCRYPT/BT_GATT_PERM_WRITE_AUTHEN (for write), if these additional permissions are not set (even in secure connections only mode) then the stack does not perform any permission checks on these characteristics and they can be freely written/read.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00350 · 27.4th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2024-02-19T21:19Z
EPSS history
Timeline
  • 19 FEB 21:19Z
    Bluetooth characteristic LESC security requirement not enforced without additional flags
    cvelistv5