CVE-2021-28135

low-risk
Published 2021-09-07

The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly handle the reception of continuous unsolicited LMP responses, allowing attackers in radio range to trigger a denial of service (crash) in ESP32 by flooding the target device with LMP Feature Response data.

Do I need to act?

-
0.28% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
6
CVSS 6.5/10 Medium
ADJACENT_NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Espressif

References (8)

Broken Link https://dl.packetstormsecurity.net/papers/general/braktooth.pdf
Third Party Advisory https://github.com/espressif/esp-idf
Third Party Advisory https://github.com/espressif/esp32-bt-lib
Product https://www.espressif.com/en/products/socs/esp32
Broken Link https://dl.packetstormsecurity.net/papers/general/braktooth.pdf
Third Party Advisory https://github.com/espressif/esp-idf
Third Party Advisory https://github.com/espressif/esp32-bt-lib
Product https://www.espressif.com/en/products/socs/esp32
27
/ 100
low-risk
Severity 21/34 · High
Exploitability 1/34 · Minimal
Exposure 5/34 · Minimal