PT-2024-1122 · Microsoft · Bluetooth Driver+1

Marc Newlin · Published 2024-01-09 · Updated 2025-09-05 · CVE-2024-21306

Positive Technologies (AI Summary)

CVSS v2.0

6.1

Medium

Base vector

AV:A/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Bluetooth Driver (affected versions not specified)

Description The issue is related to errors in the representation of information by the user interface in the Microsoft Bluetooth Driver. It allows a remote attacker to conduct spoofing attacks. The vulnerability can be exploited to pair a virtual Bluetooth keyboard without authentication or user confirmation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authentication

UI Misrepresentation of Critical Information

Weakness Enumeration

CWE-306

CWE-451

Related Identifiers

BDU:2024-00406

CVE-2024-21306

Affected Products

Bluetooth Driver

Windows

References · 21

• 🔥 https://github.com/Danyw24/blueXploit · Exploit
• 🔥 https://github.com/PhucHauDeveloper/BadBlue · Exploit
• https://osv.dev/vulnerability/CVE-2024-21306 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-21306 · Security Note
• https://bdu.fstec.ru/vul/2024-00406 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-21306 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21306 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21306 · Security Note
• https://twitter.com/Aprilhoomie/status/1750233241267609981 · Twitter Post
• https://twitter.com/hack_git/status/1748984696430604330 · Twitter Post
• https://twitter.com/r1cksec/status/1750815577663279161 · Twitter Post
• https://t.me/ckure/13434 · Telegram Post
• https://t.me/p0x3k/1682 · Telegram Post
• https://twitter.com/marcnewlin/status/1744790223530397767 · Twitter Post
• https://twitter.com/binitamshah/status/1785325338622591450 · Twitter Post