← Back

CVE-2021-28139

nvd nist
Published: Sep 7, 2021Modified: Nov 21, 2024

JSON object

Loading...
8.8
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 2.8 / Impact: 5.9
Source: NVD

Description

The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly restrict the Feature Page upon reception of an LMP Feature Response Extended packet, allowing attackers in radio range to trigger arbitrary code execution in ESP32 via a crafted Extended Features bitfield payload.

Affected (1)

Products: Espressif: Esp Idf
Espressif
1 product
Esp Idf
Configuration A
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Esp Idf
Up to 4.4
Running on/withPlatform Versions
Espressif
Esp32
All versions

References (8)

Source: cve@mitre.org
Technical DescriptionThird Party Advisory
Source: cve@mitre.org
ProductThird Party Advisory
Source: cve@mitre.org
ProductThird Party Advisory
Source: cve@mitre.org
ProductVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Technical DescriptionThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ProductThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ProductThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ProductVendor Advisory

Timeline

No history available yet.