CVE-2021-37577

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

Bluetooth LE and BR/EDR Secure Connections pairing and Secure Simple Pairing using the Passkey entry protocol in Bluetooth Core Specifications 2.1 through 5.3 may permit an unauthenticated man-in-the-middle attacker to identify the Passkey used during pairing by reflection of a crafted public key with the same X coordinate as the offered public key and by reflection of the authentication evidence of the initiating device, potentially permitting this attacker to complete authenticated pairing with the responding device using the correct Passkey for the pairing session. This is a related issue to CVE-2020-26558.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published: Oct 1, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2021

CVE-2021-375789.8Apache jUDDI uses several classes related to Java's Remote Method Invocation (RMI) which (as an extension to UDDI) provides an alternate tra CVE-2021-375799.8The Dubbo Provider will check the incoming request and the corresponding serialization type of this request meet the configuration set by th CVE-2021-37586.5bookstack is vulnerable to Server-Side Request Forgery (SSRF)CVE-2021-375809.8A flaw was found in Apache ShenYu Admin. The incorrect use of JWT in ShenyuAdminBootstrap allows an attacker to bypass authentication. This CVE-2021-375838.8MediaTek microchips, as used in NETGEAR devices through 2021-11-11 and other devices, mishandle IEEE 1905 protocols. (Affected Chipsets MT76 CVE-2021-375848.8MediaTek microchips, as used in NETGEAR devices through 2021-11-11 and other devices, mishandle the WPS (Wi-Fi Protected Setup) protocol. (A CVE-2021-375864.9The PowerPlay Web component of Mitel Interaction Recording Multitenancy systems before 6.7 could allow a user (with Administrator rights) to CVE-2021-375876.5In Charm 0.43, any single user can decrypt DAC-MACS or MA-ABE-YJ14 data.CVE-2021-375885.9In Charm 0.43, any two users can collude to achieve the ability to decrypt YCT14 data.CVE-2021-375897.5Virtua Cobranca before 12R allows SQL Injection on the login page.CVE-2021-37595.5A memory overflow vulnerability was found in the Linux kernel’s ipc functionality of the memcg subsystem, in the way a user calls the semget CVE-2021-375929.8Suricata before 5.0.8 and 6.x before 6.0.4 allows TCP evasion via a client with a crafted TCP/IP stack that can send a certain sequence of s