PT-2021-1809 · Microsoft · Windows

Published 2021-01-12 · Updated 2024-10-08 · CVE-2021-1638

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Windows (affected versions not specified)

Description: The issue is related to an impersonation vulnerability in the Passkey Entry Protocol of the Bluetooth service in Windows operating systems. This vulnerability is associated with authentication errors and can allow an attacker to elevate their privileges and gain unauthorized access to protected information.

Recommendations: To address the vulnerability, apply the software update released by Microsoft, which will fail attempts to pair if the remote device exchanges a public key with the same X coordinate as the locally exchanged public key. As a temporary workaround, consider restricting access to the Bluetooth service to minimize the risk of exploitation. At the moment, there is no information about specific versions that contain a fix for this vulnerability, but applying the mentioned software update should resolve the issue.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2021-00564

CVE-2021-1638

Affected Products

Windows

References · 12

• https://bdu.fstec.ru/vul/2021-00564 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2021-1638 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-1638 · Security Note
• https://osv.dev/vulnerability/CVE-2021-1638 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1638 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-1638 · Security Note
• https://twitter.com/windowsforum/status/1843708180502642994 · Twitter Post
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1638 · Note
• https://t.me/cvenotify/97487 · Telegram Post
• https://t.me/cvenotify/8549 · Telegram Post
• https://twitter.com/ComputerPunks/status/1843687561010811345 · Twitter Post
• https://t.me/cvenotify/65780 · Telegram Post