CVE-2021-34150 — MEDIUM (6.5)

Vulnerability Description

The Bluetooth Classic implementation on Bluetrum AB5301A devices with unknown firmware versions does not properly handle the reception of oversized DM1 LMP packets while no other BT connections are active, allowing attackers in radio range to prevent new BT connections (disabling the AB5301A inquiry and page scan procedures) via a crafted LMP packet. The user needs to manually perform a power cycle (restart) of the device to restore BT connectivity.

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

NONE

Availability

HIGH

Affected Products

Vendor	Product	Versions
Bluetrum	Ab5301A Firmware	-
Bluetrum	Ab5301A	-

References

http://www.bluetrum.com/product/ab5301a.htmlProductVendor Advisory
https://dl.packetstormsecurity.net/papers/general/braktooth.pdfTechnical DescriptionThird Party Advisory
http://www.bluetrum.com/product/ab5301a.htmlProductVendor Advisory
https://dl.packetstormsecurity.net/papers/general/braktooth.pdfTechnical DescriptionThird Party Advisory

FAQ

What is CVE-2021-34150?

CVE-2021-34150 is a vulnerability with a CVSS score of 6.5 (MEDIUM). The Bluetooth Classic implementation on Bluetrum AB5301A devices with unknown firmware versions does not properly handle the reception of oversized DM1 LMP packets while no other BT connections are ac...

How severe is CVE-2021-34150?

CVE-2021-34150 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2021-34150?

Check the references section above for vendor advisories and patch information. Affected products include: Bluetrum Ab5301A Firmware, Bluetrum Ab5301A.