{"vulnerability": "cve-2021-31609", "sightings": [{"uuid": "24b3f1af-4af0-485c-8f35-2ca05d447dfb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31609", "type": "seen", "source": "https://t.me/cibsecurity/28311", "content": "\u203c CVE-2021-31609 \u203c\n\nThe Bluetooth Classic implementation in Silicon Labs iWRAP 6.3.0 and earlier does not properly handle the reception of an oversized LMP packet greater than 17 bytes, allowing attackers in radio range to trigger a crash in WT32i via a crafted LMP packet.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-09-07T12:17:06.000000Z"}, {"uuid": "00c8d422-1afe-450e-9f92-2c5595727d66", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31609", "type": "seen", "source": "https://t.me/hacking_Attack/22454", "content": "io can lead to DoS in laptops and smartphones. Researchers were able to achieve this using gear containing Intel AX200 SoCs and Qualcomm WCN3990 SoCs.\n\nOne of the DoS bugs (CVE-2021-34147) exists because of a failure in the SoC to free resources upon receiving an invalid LMP_timing_accuracy_response from a connected BT device (i.e., a \u201cslave,\u201d according to the paper:\n\n\u201cThe attacker can exhaust the SoC by (a) paging, (b) sending the malformed packet, and (c) disconnecting without sending LMP_detach,\u201d researchers wrote. \u201cThese steps are repeated with a different BT address (i.e., BDAddress) until the SoC is exhausted from accepting new connections. On exhaustion, the SoC fails to recover itself and disrupts current active connections, triggering firmware crashes sporadically.\u201d\n\nThe researchers were able to forcibly disconnect slave BT devices from Windows and Linux laptops, and cause BT headset disruptions on Pocophone F1 and Oppo Reno 5G smartphones.\n\nAnother DoS bug (CVE pending) affects only devices using the Intel AX200 SoC.\n\nIt\u2019s triggered when an oversized LMP_timing_accuracy_request (i.e., bigger than 17 bytes) is sent to an AX200 slave.\n\n\u201cThis temporarily corrupts AX200 firmware, which responds incorrectly during a subsequent BT connection and eventually disables the paging scan procedure,\u201d researchers explained. \u201cThus, scanning AX200 works, but no connection is established from an external BT device.\u201d\n\nAside from disconnecting master BT devices connected to a vulnerable laptop and leading to sporadic BT firmware crashes, this state of affairs can also be used for man-in-the-middle (MiTM) attacks. Bad actors can easily trick a user into connecting to the attacker\u2019s BT hardware instead of the legitimate device, researchers noted \u2013 with persistence.\n\n\u201cIndeed, the user needs to manually re-enable BT to restore functionality,\u201d they said, adding, \u201cDue to the number of smartphones and laptops vulnerable to such attacks, and the common use of BT connectivity during video-conference calls and music streaming, updating the affected devices is essential.\u201d See Also: Hacking Stories: Andrian Lamo \u2013 The \u2018homeless\u2019 HackerBT Audio Product FreezesA third attack scenario was discovered while probing various BT speakers (specifically the Mi Portable Bluetooth Speaker \u2013 MDZ-36-DB, BT Headphone and BT Audio Modules) and an unbranded BT audio receiver.\n\nThey all are variously subject to a series of bugs (CVE-2021-31609 andCVE-2021-31612, failures when sending oversized LMP packets; CVE-2021-31613, truncated packets; CVE-2021-31611, starting procedures out-of-order; and CVE-2021-28135, CVE-2021-28155 and CVE-2021-31717, feature response flooding).\n\nSuccessful exploits can \u201cfreeze\u201d devices, requiring the user to manually turn on unresponsive devices afterwards. For the Xiaomi MDZ-36-DBs and JBL TUNE 500BTs, this can be done while the user is actively playing music, researchers noted.\n\n\u201cAlthough issues were found in SoCs targeted to audio products, the BT implementation can be reused in a number of SoCs destined to different BT products,\u201d they added.\n\nThese are just a few of the possible exploit scenarios; a full vulnerability listing with descriptions can be found here.\n\nThe researchers have released\u00a0a BrakTooth\u00a0proof-of-concept (PoC) tool for vendors producing BT SoCs, modules and products \u2013 available for them to use to check their gear\u2019s vulnerability.\n\nBlueTooth vulnerabilities are particularly concerning given the vast footprint that they can impact, and unfortunately, they\u2019re not that uncommon. For more, please see Threatpost\u2019s recent previous BlueTooth bug coverage:\n\n* Bluetooth Bug Opens Devices to Man-in-the-Middle Attacks\n* Bluetooth Bug Allows Man-in-the-Middle Attacks on Phones\n* Bluetooth Spoofing Bug Affects Billions of IoT Devices\nSource: threatpost.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/wordpress_[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:25.311464Z"}, {"uuid": "2fde9863-f975-4758-b460-c96f30cfb227", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31609", "type": "seen", "source": "https://t.me/hacking_Attack/22454", "content": "io can lead to DoS in laptops and smartphones. Researchers were able to achieve this using gear containing Intel AX200 SoCs and Qualcomm WCN3990 SoCs.\n\nOne of the DoS bugs (CVE-2021-34147) exists because of a failure in the SoC to free resources upon receiving an invalid LMP_timing_accuracy_response from a connected BT device (i.e., a \u201cslave,\u201d according to the paper:\n\n\u201cThe attacker can exhaust the SoC by (a) paging, (b) sending the malformed packet, and (c) disconnecting without sending LMP_detach,\u201d researchers wrote. \u201cThese steps are repeated with a different BT address (i.e., BDAddress) until the SoC is exhausted from accepting new connections. On exhaustion, the SoC fails to recover itself and disrupts current active connections, triggering firmware crashes sporadically.\u201d\n\nThe researchers were able to forcibly disconnect slave BT devices from Windows and Linux laptops, and cause BT headset disruptions on Pocophone F1 and Oppo Reno 5G smartphones.\n\nAnother DoS bug (CVE pending) affects only devices using the Intel AX200 SoC.\n\nIt\u2019s triggered when an oversized LMP_timing_accuracy_request (i.e., bigger than 17 bytes) is sent to an AX200 slave.\n\n\u201cThis temporarily corrupts AX200 firmware, which responds incorrectly during a subsequent BT connection and eventually disables the paging scan procedure,\u201d researchers explained. \u201cThus, scanning AX200 works, but no connection is established from an external BT device.\u201d\n\nAside from disconnecting master BT devices connected to a vulnerable laptop and leading to sporadic BT firmware crashes, this state of affairs can also be used for man-in-the-middle (MiTM) attacks. Bad actors can easily trick a user into connecting to the attacker\u2019s BT hardware instead of the legitimate device, researchers noted \u2013 with persistence.\n\n\u201cIndeed, the user needs to manually re-enable BT to restore functionality,\u201d they said, adding, \u201cDue to the number of smartphones and laptops vulnerable to such attacks, and the common use of BT connectivity during video-conference calls and music streaming, updating the affected devices is essential.\u201d See Also: Hacking Stories: Andrian Lamo \u2013 The \u2018homeless\u2019 HackerBT Audio Product FreezesA third attack scenario was discovered while probing various BT speakers (specifically the Mi Portable Bluetooth Speaker \u2013 MDZ-36-DB, BT Headphone and BT Audio Modules) and an unbranded BT audio receiver.\n\nThey all are variously subject to a series of bugs (CVE-2021-31609 andCVE-2021-31612, failures when sending oversized LMP packets; CVE-2021-31613, truncated packets; CVE-2021-31611, starting procedures out-of-order; and CVE-2021-28135, CVE-2021-28155 and CVE-2021-31717, feature response flooding).\n\nSuccessful exploits can \u201cfreeze\u201d devices, requiring the user to manually turn on unresponsive devices afterwards. For the Xiaomi MDZ-36-DBs and JBL TUNE 500BTs, this can be done while the user is actively playing music, researchers noted.\n\n\u201cAlthough issues were found in SoCs targeted to audio products, the BT implementation can be reused in a number of SoCs destined to different BT products,\u201d they added.\n\nThese are just a few of the possible exploit scenarios; a full vulnerability listing with descriptions can be found here.\n\nThe researchers have released\u00a0a BrakTooth\u00a0proof-of-concept (PoC) tool for vendors producing BT SoCs, modules and products \u2013 available for them to use to check their gear\u2019s vulnerability.\n\nBlueTooth vulnerabilities are particularly concerning given the vast footprint that they can impact, and unfortunately, they\u2019re not that uncommon. For more, please see Threatpost\u2019s recent previous BlueTooth bug coverage:\n\n* Bluetooth Bug Opens Devices to Man-in-the-Middle Attacks\n* Bluetooth Bug Allows Man-in-the-Middle Attacks on Phones\n* Bluetooth Spoofing Bug Affects Billions of IoT Devices\nSource: threatpost.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/wordpress_[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:57.158390Z"}]}