CVE-2019-9506 HIGH

CVE-2019-9506: Blutooth BR/EDR specification does not specify sufficient encryption key length and allows an attacker to influence key length negotiation

Vendor Bluetooth
Product BR/EDR
Weakness CWE-310
Published August 14, 2019
Last update September 16, 2024
View on NVD All CVEs

CVSS base score

7.6/10
Attack vector Adjacent
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity Low

CVSS vector

CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

What the vulnerability does

01Description

The Bluetooth BR/EDR specification up to and including version 5.1 permits sufficiently low encryption key length and does not prevent an attacker from influencing the key length negotiation. This allows practical brute-force attacks (aka "KNOB") that can decrypt traffic and inject arbitrary ciphertext without the victim noticing.

Key dates

02Disclosure timeline

August 14, 2019 CVE published
September 16, 2024 Record updated