CVEvulnerability
CVE-2021-28136
6.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2021-09-07
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 6.5 MEDIUM — CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS 2.0 ([email protected])
- 3.3 LOW — AV:A/AC:L/Au:N/C:N/I:N/A:P
- Weaknesses
- CWE-787
Description
The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly handle the reception of multiple LMP IO Capability Request packets during the pairing process, allowing attackers in radio range to trigger memory corruption (and consequently a crash) in ESP32 via a replayed (duplicated) LMP packet.
Affected configurations
• espressif esp-idf (<= 4.4)
Related
Weakness · CWE (1)
- CWE-787 Out-of-bounds Write weakness
References
- https://dl.packetstormsecurity.net/papers/general/braktooth.pdf Technical Description, Third Party Advisory
- https://github.com/espressif/esp-idf Product, Third Party Advisory
- https://github.com/espressif/esp32-bt-lib Product, Third Party Advisory
- https://www.espressif.com/en/products/socs/esp32 Product, Vendor Advisory
- https://dl.packetstormsecurity.net/papers/general/braktooth.pdf Technical Description, Third Party Advisory
- https://github.com/espressif/esp-idf Product, Third Party Advisory
- https://github.com/espressif/esp32-bt-lib Product, Third Party Advisory
- https://www.espressif.com/en/products/socs/esp32 Product, Vendor Advisory