PoC Index85,101 CVEs with PoCs

CVE-2019-9506

Blutooth BR/EDR specification does not specify sufficient encryption key length and allows an attacker to influence key length negotiation

HIGH 8.1EPSS 2.7%

The Bluetooth BR/EDR specification up to and including version 5.1 permits sufficiently low encryption key length and does not prevent an attacker from influencing the key length negotiation. This allows practical brute-force attacks (aka "KNOB") that can decrypt traffic and inject arbitrary ciphertext without the victim noticing.

Affected
Bluetooth · BR/EDR
CVSS v3.1 NVD
8.1 HIGHCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v3.0 CERT
7.6 HIGHCVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
CVSS v2.0 NVD
4.8 MEDIUMAV:A/AC:L/Au:N/C:P/I:P/A:N
EPSS
2.69% chance of exploitation in the next 30 days, 86th percentile
Published
2019-08-14
Updated
2024-09-16

Proof-of-concept exploits (2)

Security advisories

References