1. Home
  2. CVE Database
  3. CVE-2019-17627
MEDIUM · 6.5

CVE-2019-17627

The Yale Bluetooth Key application for mobile devices allows unauthorized unlock actions by sniffing Bluetooth Low Energy (BLE) traffic during one authorized unlock action, and then calculating the au...

Vulnerability Description

The Yale Bluetooth Key application for mobile devices allows unauthorized unlock actions by sniffing Bluetooth Low Energy (BLE) traffic during one authorized unlock action, and then calculating the authentication key via simple computations on the hex digits of a valid authentication request. This affects the Yale ZEN-R lock and unspecified other locks.

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector
ADJACENT_NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
YalehomeYale Bluetooth Key-

Related Weaknesses (CWE)

CWE-287

References

FAQ

What is CVE-2019-17627?

CVE-2019-17627 is a vulnerability with a CVSS score of 6.5 (MEDIUM). The Yale Bluetooth Key application for mobile devices allows unauthorized unlock actions by sniffing Bluetooth Low Energy (BLE) traffic during one authorized unlock action, and then calculating the au...

How severe is CVE-2019-17627?

CVE-2019-17627 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2019-17627?

Check the references section above for vendor advisories and patch information. Affected products include: Yalehome Yale Bluetooth Key.