PT-2021-4308 · Zhuhai Jieli · Ac690X

Published 2021-09-07 · Updated 2021-09-15 · CVE-2021-31612

Positive Technologies (AI Summary)

CVSS v2.0

6.1

Medium

Base vector

AV:A/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Zhuhai Jieli AC690X devices (affected versions not specified)

Description The Bluetooth Classic implementation does not properly handle the reception of an oversized LMP packet greater than 17 bytes during the LMP auto rate procedure. This allows attackers in radio range to trigger a deadlock via a crafted LMP packet. The issue exists due to insufficient input validation in the Bluetooth Classic implementation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2021-04917

CVE-2021-31612

Affected Products

Ac690X

References · 6

• http://zh-jieli.com/product/68-cn.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-31612 · Security Note
• https://bdu.fstec.ru/vul/2021-04917 · Security Note
• https://t.me/cibsecurity/28323 · Telegram Post
• https://dl.packetstormsecurity.net/papers/general/braktooth.pdf · Note
• https://launchstudio.bluetooth.com/ListingDetails/19746 · Note