PT-2020-10083 · Telink Semiconductor · Telink Semiconductor Ble Sdk

Published 2020-02-12 · Updated 2020-08-24 · CVE-2019-19194

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Telink Semiconductor BLE SDK versions before November 2019 for TLSR8x5x through 3.4.0 Telink Semiconductor BLE SDK versions before November 2019 for TLSR823x through 1.3.0 Telink Semiconductor BLE SDK versions before November 2019 for TLSR826x through 3.3

Description The Bluetooth Low Energy Secure Manager Protocol implementation has an issue where it installs a zero long term key if an out-of-order link-layer encryption request is received during Secure Connections pairing. This allows an attacker in radio range to have arbitrary read/write access to protected GATT service data, cause a device crash, or possibly control a device's function by establishing an encrypted session with the zero LTK.

Recommendations For Telink Semiconductor BLE SDK versions before November 2019 for TLSR8x5x through 3.4.0, update to a version released after November 2019 to ensure the Secure Manager Protocol implementation is secure. For Telink Semiconductor BLE SDK versions before November 2019 for TLSR823x through 1.3.0, update to a version released after November 2019 to ensure the Secure Manager Protocol implementation is secure. For Telink Semiconductor BLE SDK versions before November 2019 for TLSR826x through 3.3, update to a version released after November 2019 to ensure the Secure Manager Protocol implementation is secure.

Exploit

Fix

Related Identifiers

CVE-2019-19194

Affected Products

Telink Semiconductor Ble Sdk

References · 4

• 🔥 https://asset-group.github.io/disclosures/sweyntooth · Exploit
• http://telink-semi.com/ble · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-19194 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-19194 · Security Note