PT-2020-10081 · Stmicroelectronics · Stmicroelectronics Ble Stack

Published 2020-02-12 · Updated 2020-02-26 · CVE-2019-19192

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions STMicroelectronics BLE Stack versions through 1.3.1 for STM32WB5x devices

Description The Bluetooth Low Energy implementation does not properly handle consecutive Attribute Protocol (ATT) requests on reception, allowing attackers in radio range to cause an event deadlock or crash via crafted packets.

Recommendations For STMicroelectronics BLE Stack versions through 1.3.1, consider disabling the reception of consecutive Attribute Protocol (ATT) requests as a temporary workaround until a patch is available. Restrict access to the Bluetooth Low Energy implementation to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2019-19192

Affected Products

Stmicroelectronics Ble Stack

References · 4

• 🔥 https://asset-group.github.io/disclosures/sweyntooth · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-19192 · Security Note
• https://osv.dev/vulnerability/CVE-2019-19192 · Vendor Advisory
• https://t.me/cvenotify/947 · Telegram Post