CVEvulnerability
CVE-2021-28139
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2021-09-07
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 8.3 HIGH — AV:A/AC:L/Au:N/C:C/I:C/A:C
Description
The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly restrict the Feature Page upon reception of an LMP Feature Response Extended packet, allowing attackers in radio range to trigger arbitrary code execution in ESP32 via a crafted Extended Features bitfield payload.
Affected configurations
• espressif esp-idf (<= 4.4)
References
- https://dl.packetstormsecurity.net/papers/general/braktooth.pdf Technical Description, Third Party Advisory
- https://github.com/espressif/esp-idf Product, Third Party Advisory
- https://github.com/espressif/esp32-bt-lib Product, Third Party Advisory
- https://www.espressif.com/en/products/socs/esp32 Product, Vendor Advisory
- https://dl.packetstormsecurity.net/papers/general/braktooth.pdf Technical Description, Third Party Advisory
- https://github.com/espressif/esp-idf Product, Third Party Advisory
- https://github.com/espressif/esp32-bt-lib Product, Third Party Advisory
- https://www.espressif.com/en/products/socs/esp32 Product, Vendor Advisory