Medium severity · published Feb 10, 2020
CVE-2019-17520
The Bluetooth Low Energy implementation on Texas Instruments SDK through 3.30.00.20 for CC2640R2 devices does not properly restrict the SM Public Key packet on reception, allowing…
6.5
CVSS
1.8%
EPSS
No
On KEV
Description
The Bluetooth Low Energy implementation on Texas Instruments SDK through 3.30.00.20 for CC2640R2 devices does not properly restrict the SM Public Key packet on reception, allowing attackers in radio range to cause a denial of service (crash) via crafted packets.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 79% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CS
Cc2640r2 Software Development Kit · TI
through 3.30.00.20 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-17520
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-17520
Product
http://www.ti.com/tool/LAUNCHXL-CC2640R2
Third Party Advisory
https://asset-group.github.io/disclosures/sweyntooth/
Exploit
https://www.youtube.com/watch?v=Iw8sIBLWE_w
More from Cc2640r2 Software Development Kit
6.5
CVE-2019-19193
The Bluetooth Low Energy peripheral implementation on Texas Instruments SIMPLELINK-CC2640R2-SDK through 3.30.00.20 and BLE-STACK through 1.5.0 before Q4 2019 for CC2640R2 and…