CoreCVE
Back

MEDIUM

The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly handle the reception of multiple LMP IO Capability Request packets during the pairing process, allowing attackers in radio range to trigger memory corruption (and consequently a crash) in ESP32 via a replayed (duplicated) LMP packet

Published Sep 7, 2021

Description

The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly handle the reception of multiple LMP IO Capability Request packets during the pairing process, allowing attackers in radio range to trigger memory corruption (and consequently a crash) in ESP32 via a replayed (duplicated) LMP packet.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-787

Out-of-bounds Write

References (5)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Sep 7, 2021
Updated Aug 3, 2024
Reserved Mar 11, 2021
Link CVE-2021-28136
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2021-28136
Red Hat
Severity n/a
Public date n/a
Links CVE-2021-28136
ENISA EUVD
Assigner mitre
Published Sep 7, 2021
Updated Aug 3, 2024
Exploited since n/a
Link EUVD-2021-14835
EUVD-2021-14835