CVE-2019-19196 — MEDIUM (6.5)

Q: How severe is CVE-2019-19196?

CVE-2019-19196 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2019-19196?

Check the references section above for vendor advisories and patch information. Affected products include: Telink-Semi Tlsr8258 Ble Sdk, Telink-Semi Tlsr8258, Telink-Semi Tlsr8269 Ble Sdk, Telink-Semi Tlsr8269, Telink-Semi Tlsr8253 Ble Sdk.

Vulnerability Description

The Bluetooth Low Energy Secure Manager Protocol (SMP) implementation on Telink Semiconductor BLE SDK versions before November 2019 for TLSR8x5x through 3.4.0, TLSR823x through 1.3.0, and TLSR826x through 3.3 devices accepts a pairing request with a key size greater than 16 bytes, allowing an attacker in radio range to cause a buffer overflow and denial of service (crash) via crafted packets.

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

NONE

Availability

HIGH

Affected Products

Vendor	Product	Versions
Telink-Semi	Tlsr8258 Ble Sdk	<= 3.4.0
Telink-Semi	Tlsr8258	-
Telink-Semi	Tlsr8269 Ble Sdk	<= 3.3
Telink-Semi	Tlsr8269	-
Telink-Semi	Tlsr8253 Ble Sdk	<= 3.4.0
Telink-Semi	Tlsr8253	-
Telink-Semi	Tlsr8251 Ble Sdk	<= 3.4.0
Telink-Semi	Tlsr8251	-
Telink-Semi	Tlsr8232 Ble Sdk	<= 1.3.0
Telink-Semi	Tlsr8232	-

Related Weaknesses (CWE)

CWE-120

References

http://www.telink-semi.com/bleVendor Advisory
https://asset-group.github.io/disclosures/sweyntooth/ExploitThird Party Advisory
http://www.telink-semi.com/bleVendor Advisory
https://asset-group.github.io/disclosures/sweyntooth/ExploitThird Party Advisory

FAQ

What is CVE-2019-19196?

CVE-2019-19196 is a vulnerability with a CVSS score of 6.5 (MEDIUM). The Bluetooth Low Energy Secure Manager Protocol (SMP) implementation on Telink Semiconductor BLE SDK versions before November 2019 for TLSR8x5x through 3.4.0, TLSR823x through 1.3.0, and TLSR826x thr...

How severe is CVE-2019-19196?

CVE-2019-19196 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2019-19196?

Check the references section above for vendor advisories and patch information. Affected products include: Telink-Semi Tlsr8258 Ble Sdk, Telink-Semi Tlsr8258, Telink-Semi Tlsr8269 Ble Sdk, Telink-Semi Tlsr8269, Telink-Semi Tlsr8253 Ble Sdk.