Aether-B

15 of 15 entries

ID	Risk	Title	CVSS	CWE
`AETHB-001`	INFO	KNOB Attack — Bluetooth Entropy Reduction The Key Negotiation of Bluetooth (KNOB) attack allows an attacker in wireless range to force Bluetooth BR/EDR connection...	9.3	—
`AETHB-002`	INFO	BIAS Attack — Bluetooth Impersonation and Authentication Bypass The Bluetooth Impersonation Attack (BIAS) exploits weaknesses in the Bluetooth Classic (BR/EDR) legacy secure connection...	9.1	—
`AETHB-003`	INFO	BLUFFS Attack — Forward Secrecy Broken in Bluetooth Sessions BLUFFS (Bluetooth Forward and Future Secrecy) is a set of six attacks against the Bluetooth session establishment proced...	8.2	—
`AETHB-004`	INFO	BLE Legacy Pairing — Crackable Temporary Key (TK) Bluetooth Low Energy devices using the legacy pairing procedure (SMP v1) with Just Works or Passkey Entry methods are vu...	8.0	—
`AETHB-005`	INFO	Bluetooth PIN Brute Force — Short PIN or Static Passkey Bluetooth Classic devices using the legacy PIN-based pairing procedure (pre-SSP) or BLE devices using Passkey Entry with...	7.5	—
`AETHB-006`	INFO	Unauthenticated GATT Characteristics — Sensitive Data Exposed Without Authentication One or more GATT characteristics exposing sensitive data (e.g., health metrics, device configuration, credentials, telem...	6.5	—
`AETHB-007`	INFO	GATT Write Without Response — Unauthenticated Command Injection One or more GATT characteristics support the Write Without Response (ATT_WRITE_CMD) operation without requiring an authe...	6.8	—
`AETHB-008`	INFO	BlueToolkit CVE Exploitation — Remote Code Execution via Known Bluetooth Stack CVE The target Bluetooth device is running a firmware or Bluetooth stack version affected by one or more publicly known CVEs...	8.5	—
`AETHB-009`	INFO	SDP Information Disclosure — Service Discovery Leaks Internal Service Information The Bluetooth Service Discovery Protocol (SDP) on the target device responds to unauthenticated browse requests with det...	4.0	—
`AETHB-010`	INFO	Bluetooth Eavesdropping — Passive Capture of Unencrypted BR/EDR Traffic Bluetooth Classic (BR/EDR) traffic between the target and one or more paired devices was observed in cleartext or with a...	6.5	—
`AETHB-011`	INFO	BLE Beacon Tracking — Static MAC Address Enables Persistent Device Tracking The target BLE device broadcasts advertising packets containing a static or non-rotating public MAC address, allowing an...	3.7	—
`AETHB-012`	INFO	Insecure BLE Pairing Mode — Just Works Pairing with No Authentication The target BLE device accepts pairing using the Just Works association model, which provides no protection against man-i...	5.9	—
`AETHB-013`	INFO	GATTacker MITM — BLE Man-in-the-Middle via Device Cloning The target BLE device is susceptible to a man-in-the-middle attack using GATTacker, a tool that clones the GATT service ...	7.8	—
`AETHB-014`	INFO	Bluetooth Denial of Service — ACL/SCO Flooding Causing Device Disconnect The target Bluetooth device is susceptible to denial-of-service via rapid ACL connection request flooding, malformed SCO...	5.3	—
`AETHB-015`	INFO	Firmware Extraction via JTAG/SWD — Physical Firmware Dump The target Bluetooth device exposes an unprotected JTAG or SWD debug interface on the PCB that allows extraction of the ...	7.2	—

Detailed View

INFO AETHB-001 — KNOB Attack — Bluetooth Entropy Reduction

Description: The Key Negotiation of Bluetooth (KNOB) attack allows an attacker in wireless range to force Bluetooth BR/EDR connections to use a 1-byte entropy key. The Bluetooth specification allows entropy negotiation during connection establishment via the LMP protocol without authentication or integrity protection. An unauthenticated attacker within radio range can inject a modified LMP_encryption_key_size_req packet forcing both devices to accept a single-byte encryption key, which can then be brute-forced in real time. All standard-compliant Bluetooth devices are affected unless the implementation enforces a minimum entropy of 7 or more bytes regardless of negotiated value.

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

INFO AETHB-002 — BIAS Attack — Bluetooth Impersonation and Authentication Bypass

Description: The Bluetooth Impersonation Attack (BIAS) exploits weaknesses in the Bluetooth Classic (BR/EDR) legacy secure connection authentication procedure. An attacker that knows the Bluetooth address of a previously paired device can impersonate that device by initiating a connection with a role switch before mutual authentication completes. The attack exploits the fact that the Bluetooth specification does not require mutual authentication when the legacy authentication procedure is used, and allows one side to downgrade to unauthenticated link-key derivation. A successful BIAS attack grants the attacker the ability to connect to a victim device posing as a trusted peer without knowledge of the link key.

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

INFO AETHB-003 — BLUFFS Attack — Forward Secrecy Broken in Bluetooth Sessions

Description: BLUFFS (Bluetooth Forward and Future Secrecy) is a set of six attacks against the Bluetooth session establishment procedure that break forward and future secrecy of Bluetooth sessions. The vulnerabilities stem from architectural flaws in the Bluetooth specification: session keys are derived from a single long-term secret (link key or LTK) and two nonces using a non-forward-secret key derivation function (KDF). An attacker who compromises a single session key can impersonate either Bluetooth device in past and future sessions without re-pairing. The attacks apply to both Bluetooth Classic and Bluetooth Low Energy, including Secure Connections mode.

CVSS Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

INFO AETHB-004 — BLE Legacy Pairing — Crackable Temporary Key (TK)

Description: Bluetooth Low Energy devices using the legacy pairing procedure (SMP v1) with Just Works or Passkey Entry methods are vulnerable to offline brute-force recovery of the Temporary Key (TK). In Just Works pairing, the TK is always 0x0000...0000 (128 bits of zeros), making passive capture sufficient to derive the Short-Term Key (STK) and subsequently the Long-Term Key (LTK). In Passkey Entry pairing, the TK is a 6-digit PIN (max 1,000,000 values) that can be brute-forced offline from a captured pairing exchange. The crackle tool automates this attack. Any passive observer within radio range during the pairing event can permanently decrypt the session.

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

INFO AETHB-005 — Bluetooth PIN Brute Force — Short PIN or Static Passkey

Description: Bluetooth Classic devices using the legacy PIN-based pairing procedure (pre-SSP) or BLE devices using Passkey Entry with predictable PINs are susceptible to brute-force or dictionary-based passkey recovery. Common vulnerabilities include: static PINs (e.g., '0000', '1234', '1111') hardcoded in firmware, PINs derived from device MAC address or serial number, and short PINs (4 digits or fewer) that reduce the keyspace to 10,000 values. An attacker that can observe or replay pairing exchanges can brute-force the PIN offline and decrypt all traffic protected with the derived link key.

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

INFO AETHB-006 — Unauthenticated GATT Characteristics — Sensitive Data Exposed Without Authentication

Description: One or more GATT characteristics exposing sensitive data (e.g., health metrics, device configuration, credentials, telemetry) are readable by any unauthenticated BLE central device within radio range. The ATT Read Request does not require the initiating device to prove identity or possess any shared secret. This allows an attacker to passively connect and read sensitive characteristic values without prior pairing or bonding. Affected characteristic types commonly include: battery level, device name, firmware version, configuration parameters, and domain-specific sensor data.

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

INFO AETHB-007 — GATT Write Without Response — Unauthenticated Command Injection

Description: One or more GATT characteristics support the Write Without Response (ATT_WRITE_CMD) operation without requiring an authenticated or encrypted connection. This allows any BLE device within range to send arbitrary command payloads to the target without authentication. Depending on the characteristic function, this may enable: device configuration modification, command injection into actuator logic, firmware update initiation, or denial-of-service via malformed payloads. Write Without Response is particularly dangerous because the central receives no ATT error response, making attack packets harder to detect.

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

INFO AETHB-008 — BlueToolkit CVE Exploitation — Remote Code Execution via Known Bluetooth Stack CVE

Description: The target Bluetooth device is running a firmware or Bluetooth stack version affected by one or more publicly known CVEs for which proof-of-concept exploits are available in the BlueToolkit framework. BlueToolkit consolidates exploit implementations for vulnerabilities including BlueBorne (CVE-2017-0785, CVE-2017-0781), BLESA, SweynTooth, and related Bluetooth/BLE stack vulnerabilities. Exploitation may result in remote code execution, memory corruption, or full device takeover without any user interaction or prior pairing.

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

INFO AETHB-009 — SDP Information Disclosure — Service Discovery Leaks Internal Service Information

Description: The Bluetooth Service Discovery Protocol (SDP) on the target device responds to unauthenticated browse requests with detailed service records. The exposed records may include: internal service names and descriptions, protocol stack versions, RFCOMM channel assignments, OBEX service availability, PAN/NAP profile configuration, and device role information. This information assists attackers in identifying further attack surface, fingerprinting the device type and firmware version, and planning targeted exploitation of specific Bluetooth profiles.

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

INFO AETHB-010 — Bluetooth Eavesdropping — Passive Capture of Unencrypted BR/EDR Traffic

Description: Bluetooth Classic (BR/EDR) traffic between the target and one or more paired devices was observed in cleartext or with a known/recoverable session key. Using an Ubertooth One or similar hardware sniffer, an attacker within radio range can capture BR/EDR ACL and SCO frames. If the encryption key was negotiated with reduced entropy (see KNOB, AETHB-001) or a captured pairing exchange reveals the link key, all historical and future sessions can be decrypted. Sensitive data exposed may include: RFCOMM serial data, HFP audio streams, A2DP audio, OBEX file transfers, and HID input events.

CVSS Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

INFO AETHB-011 — BLE Beacon Tracking — Static MAC Address Enables Persistent Device Tracking

Description: The target BLE device broadcasts advertising packets containing a static or non-rotating public MAC address, allowing any passive observer within radio range to persistently track the device's presence and movements over time. BLE devices are required by the specification to support random address rotation to prevent tracking; however, many IoT devices use fixed public addresses for simplicity or compatibility reasons. An attacker can build a timeline of device appearances at multiple locations using commercially available BLE scanning hardware, enabling physical surveillance of device owners.

CVSS Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

INFO AETHB-012 — Insecure BLE Pairing Mode — Just Works Pairing with No Authentication

Description: The target BLE device accepts pairing using the Just Works association model, which provides no protection against man-in-the-middle attacks. In Just Works pairing, both devices compute a shared secret without any out-of-band or in-band confirmation that the correct peer is being paired. An attacker positioned between the two devices during the pairing event can silently intercept and relay the SMP exchange, completing the pairing with both devices and establishing themselves as a transparent MITM relay. The resulting bonded keys are then known to the attacker, enabling persistent session decryption.

CVSS Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

INFO AETHB-013 — GATTacker MITM — BLE Man-in-the-Middle via Device Cloning

Description: The target BLE device is susceptible to a man-in-the-middle attack using GATTacker, a tool that clones the GATT service and characteristic profile of the target and presents a spoofed advertising identity to the legitimate central device. When the central connects to the rogue peripheral (which mirrors all GATT reads/writes to the real target), the attacker observes and may modify all BLE application traffic in transit. Attack prerequisites include: the target uses Just Works or no pairing (AETHB-012), or the attacker was present during initial pairing to capture keys. The attacker can read sensitive characteristics, inject writes, and replay or modify commands without detection.

CVSS Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

INFO AETHB-014 — Bluetooth Denial of Service — ACL/SCO Flooding Causing Device Disconnect

Description: The target Bluetooth device is susceptible to denial-of-service via rapid ACL connection request flooding, malformed SCO packet injection, or L2CAP/RFCOMM protocol fuzzing. Sustained flooding of connection requests from spoofed source addresses exhausts the device's connection table, preventing legitimate devices from connecting. In some firmware implementations, receipt of malformed packets at the HCI or L2CAP layer causes device reset or service crash. Testing was conducted only after explicit authorization (dos_authorized=true in configuration).

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

INFO AETHB-015 — Firmware Extraction via JTAG/SWD — Physical Firmware Dump

Description: The target Bluetooth device exposes an unprotected JTAG or SWD debug interface on the PCB that allows extraction of the full firmware image using OpenOCD and a hardware debug probe. The extracted firmware can be reverse-engineered to recover: hardcoded Bluetooth link keys or LTKs, Wi-Fi/BLE credentials stored in flash, cryptographic secrets used for application-layer authentication, and intellectual property in the firmware binary. Debug port access was not locked via JTAG fuses or access port protection (APProtect/RDPROT). Testing was conducted only with physical_access=true in configuration and explicit written authorization.

CVSS Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H