PT-2021-1956 · Microsoft · Windows

Published 2021-01-12 · Updated 2024-10-08 · CVE-2021-1684

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Windows (affected versions not specified)

Description: The issue is related to an impersonation vulnerability in the Passkey Entry Protocol of the Bluetooth service in Windows operating systems. This vulnerability is associated with authentication errors and can allow an attacker to elevate their privileges and gain unauthorized access to protected information.

Recommendations: To address the vulnerability, apply the software update released by Microsoft, which will fail attempts to pair if the remote device exchanges a public key with the same X coordinate as the locally exchanged public key. As a temporary workaround, consider restricting access to the Bluetooth service until a patch is available. Avoid using the Bluetooth service for pairing devices until the issue is resolved.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2021-00762

CVE-2021-1684

Affected Products

Windows

References · 10

• https://osv.dev/vulnerability/CVE-2021-1684 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1684 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-00762 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-1684 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2021-1684 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-1684 · Security Note
• https://t.me/cvenotify/8549 · Telegram Post
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1684 · Note
• https://twitter.com/ComputerPunks/status/1843687562130694613 · Twitter Post
• https://twitter.com/windowsforum/status/1843691752173015484 · Twitter Post