CVE-2021-28139

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly restrict the Feature Page upon reception of an LMP Feature Response Extended packet, allowing attackers in radio range to trigger arbitrary code execution in ESP32 via a crafted Extended Features bitfield payload.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://dl.packetstormsecurity.net/papers/general/braktooth.pdfTechnical Description, Third Party Advisory
https://github.com/espressif/esp-idfProduct, Third Party Advisory
https://github.com/espressif/esp32-bt-libProduct, Third Party Advisory
https://www.espressif.com/en/products/socs/esp32Product, Vendor Advisory
https://dl.packetstormsecurity.net/papers/general/braktooth.pdfTechnical Description, Third Party Advisory
https://github.com/espressif/esp-idfProduct, Third Party Advisory
https://github.com/espressif/esp32-bt-libProduct, Third Party Advisory
https://www.espressif.com/en/products/socs/esp32Product, Vendor Advisory

Timeline

Published: Sep 7, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-281419.8An issue was discovered in Progress Telerik UI for ASP.NET AJAX 2021.1.224. It allows unauthorized access to MicrosoftAjax.js through the Te CVE-2021-281428.8CITSmart before 9.1.2.28 mishandles the "filtro de autocomplete."CVE-2021-281438.0/jsonrpc on D-Link DIR-841 3.03 and 3.04 devices allows authenticated command injection via ping, ping6, or traceroute (under System Tools).CVE-2021-281448.8prog.cgi on D-Link DIR-3060 devices before 1.11b04 HF2 allows remote authenticated users to inject arbitrary commands in an admin or root co CVE-2021-281455.4Concrete CMS (formerly concrete5) before 8.5.5 allows remote authenticated users to conduct XSS attacks via a crafted survey block. This req CVE-2021-281466.5The team sync HTTP API in Grafana Enterprise 7.4.x before 7.4.5 has an Incorrect Access Control issue. On Grafana instances using an externa CVE-2021-281476.5The team sync HTTP API in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 has an Incorrect Access Control iss CVE-2021-281487.5One of the usage insights HTTP API endpoints in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 is accessible CVE-2021-281496.5Hongdian H8922 3.0.5 devices allow Directory Traversal. The /log_download.cgi log export handler does not validate user input and allows a r CVE-2021-281505.5Hongdian H8922 3.0.5 devices allow the unprivileged guest user to read cli.conf (with the administrator password and other sensitive data) v CVE-2021-281518.8Hongdian H8922 3.0.5 devices allow OS command injection via shell metacharacters into the ip-address (aka Destination) field to the tools.cg CVE-2021-281529.8Hongdian H8922 3.0.5 devices have an undocumented feature that allows access to a shell as a superuser. To connect, the telnet service is us