PT-2024-18801 · Unknown · Bluetooth Low Energy

Published 2024-07-02 · Updated 2024-07-05 · CVE-2024-20889

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H

Name of the Vulnerable Software and Affected Versions Bluetooth Low Energy (BLE) versions prior to SMR Jul-2024 Release 1

Description The issue is related to improper authentication in BLE, allowing adjacent attackers to pair with devices. This could potentially lead to unauthorized access.

Recommendations For versions prior to SMR Jul-2024 Release 1, update to SMR Jul-2024 Release 1 or later to resolve the issue. As a temporary workaround, consider restricting device pairing to trusted devices only until the update is applied.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2024-20889

Affected Products

Bluetooth Low Energy

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-20889 · Security Note
• https://osv.dev/vulnerability/CVE-2024-20889 · Vendor Advisory
• https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=07 · Vendor Advisory
• https://t.me/cvenotify/84982 · Telegram Post
• https://t.me/cvenotify/85226 · Telegram Post