Description
Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 through 5.2 may permit a nearby man-in-the-middle attacker to identify the Passkey used during pairing (in the Passkey authentication procedure) by reflection of the public key and the authentication evidence of the initiating device, potentially permitting this attacker to complete authenticated pairing with the responding device using the correct Passkey for the pairing session. The attack methodology determines the Passkey value one bit at a time.
Metrics
CVSS 3.1 4.2/10
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:NWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
References
- https://kb.cert.org/vuls/id/799380Third Party Advisory, US Government Resource
- https://lists.debian.org/debian-lts-announce/2021/06/msg00019.htmlMailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/06/msg00020.htmlMailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/06/msg00022.htmlMailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NSS6CTGE4UGTJLCOZOASDR3T3SLL6QJZ/
- https://security.gentoo.org/glsa/202209-16Third Party Advisory
- https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/reporting-security/Vendor Advisory
- https://www.debian.org/security/2021/dsa-4951Third Party Advisory
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00517.htmlThird Party Advisory
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00520.htmlThird Party Advisory
- https://kb.cert.org/vuls/id/799380Third Party Advisory, US Government Resource
- https://lists.debian.org/debian-lts-announce/2021/06/msg00019.htmlMailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/06/msg00020.htmlMailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/06/msg00022.htmlMailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NSS6CTGE4UGTJLCOZOASDR3T3SLL6QJZ/
- https://security.gentoo.org/glsa/202209-16Third Party Advisory
- https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/reporting-security/Vendor Advisory
- https://www.debian.org/security/2021/dsa-4951Third Party Advisory
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00517.htmlThird Party Advisory
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00520.htmlThird Party Advisory
- https://www.kb.cert.org/vuls/id/799380
Timeline
- Published
- May 24, 2021
- Last modified
- Jun 17, 2026
- NVD status
- Modified