Vulnerability Description
The Bluetooth Low Energy (BLE) controller implementation in Espressif ESP-IDF 4.0 through 4.2 (for ESP32 devices) returns the wrong number of completed BLE packets and triggers a reachable assertion on the host stack when receiving a packet with an MIC failure. An attacker within radio range can silently trigger the assertion (which disables the target's BLE stack) by sending a crafted sequence of BLE packets.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Espressif | Esp-Idf | >= 4.0.0, <= 4.2 |
| Espressif | Esp32 | - |
Related Weaknesses (CWE)
References
- https://asset-group.github.io/cves.htmlThird Party Advisory
- https://asset-group.github.io/disclosures/sweyntooth/Third Party Advisory
- https://github.com/espressif/esp32-bt-libThird Party Advisory
- https://asset-group.github.io/cves.htmlThird Party Advisory
- https://asset-group.github.io/disclosures/sweyntooth/Third Party Advisory
- https://github.com/espressif/esp32-bt-libThird Party Advisory
FAQ
What is CVE-2020-13595?
CVE-2020-13595 is a vulnerability with a CVSS score of 6.5 (MEDIUM). The Bluetooth Low Energy (BLE) controller implementation in Espressif ESP-IDF 4.0 through 4.2 (for ESP32 devices) returns the wrong number of completed BLE packets and triggers a reachable assertion o...
How severe is CVE-2020-13595?
CVE-2020-13595 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-13595?
Check the references section above for vendor advisories and patch information. Affected products include: Espressif Esp-Idf, Espressif Esp32.