PT-2021-4299 · Zhuhai Jieli · Ac692X+1

Published 2021-09-07 · Updated 2021-09-09 · CVE-2021-31613

Positive Technologies (AI Summary)

CVSS v2.0

3.3

Low

Base vector

AV:A/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Zhuhai Jieli AC690X and AC692X devices (affected versions not specified)

Description The Bluetooth Classic implementation does not properly handle the reception of a truncated LMP packet during the LMP auto rate procedure. This allows attackers in radio range to immediately crash and restart a device via a crafted LMP packet. The issue exists due to insufficient input validation in the Bluetooth Classic implementation.

Recommendations For Zhuhai Jieli AC690X and AC692X devices, consider disabling Bluetooth functionality until a patch is available to prevent exploitation. Restrict access to devices to minimize the risk of exploitation by attackers in radio range. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2021-04908

CVE-2021-31613

Affected Products

Ac690X

Ac692X

References · 7

• http://zh-jieli.com/product/68-cn.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04908 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-31613 · Security Note
• https://dl.packetstormsecurity.net/papers/general/braktooth.pdf · Note
• https://launchstudio.bluetooth.com/ListingDetails/58628 · Note
• https://t.me/cibsecurity/28312 · Telegram Post
• https://launchstudio.bluetooth.com/ListingDetails/19746 · Note