CVE-2023-2002

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in the HCI sockets implementation due to a missing capability check in net/bluetooth/hci_sock.c in the Linux Kernel. This flaw allows an attacker to unauthorized execution of management commands, compromising the confidentiality, integrity, and availability of Bluetooth communication.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

Weakness enumeration

CWE-250 CWE-863

Affected software

Vendor	Product	Versions
n/a	Kernel	Kernel prior to Kernel 6.4-rc1

References

https://lists.debian.org/debian-lts-announce/2023/07/msg00030.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/10/msg00027.htmlMailing List, Third Party Advisory
https://security.netapp.com/advisory/ntap-20240202-0004/
https://www.debian.org/security/2023/dsa-5480Third Party Advisory
https://www.openwall.com/lists/oss-security/2023/04/16/3Exploit, Mailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/07/msg00030.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/10/msg00027.htmlMailing List, Third Party Advisory
https://security.netapp.com/advisory/ntap-20240202-0004/
https://www.debian.org/security/2023/dsa-5480Third Party Advisory
https://www.openwall.com/lists/oss-security/2023/04/16/3Exploit, Mailing List, Third Party Advisory

Timeline

Published: May 26, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-200208.6A vulnerability in the Device Management Servlet application of Cisco BroadWorks Application Delivery Platform and Cisco BroadWorks Xtended CVE-2023-200216.7Multiple vulnerabilities in specific Cisco Identity Services Engine (ISE) CLI commands could allow an authenticated, local attacker to perfo CVE-2023-200226.7Multiple vulnerabilities in specific Cisco Identity Services Engine (ISE) CLI commands could allow an authenticated, local attacker to perfo CVE-2023-200236.7Multiple vulnerabilities in specific Cisco Identity Services Engine (ISE) CLI commands could allow an authenticated, local attacker to perfo CVE-2023-200247.5Multiple vulnerabilities in the web-based user interface of certain Cisco Small Business Series Switches could allow an unauthenticated, rem CVE-2023-200259.8A vulnerability in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, and RV082 Routers could allow an unauthe CVE-2023-200267.2A vulnerability in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320 and RV325 Routers could all CVE-2023-200278.6A vulnerability in the implementation of the IPv4 Virtual Fragmentation Reassembly (VFR) feature of Cisco IOS XE Software could allow an una CVE-2023-200285.4Multiple vulnerabilities in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager; Cisco Secur CVE-2023-200297.8A vulnerability in the Meraki onboarding feature of Cisco IOS XE Software could allow an authenticated, local attacker to gain root level pr CVE-2023-20039.8Embedded malicious code vulnerability in Vision1210, in the build 5 of operating system version 4.3, which could allow a remote attacker to CVE-2023-200306.0A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker