Medium severity · published Dec 19, 2022
CVE-2022-46400
The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) allows attackers to bypass passkey entry in legacy pairing
5.4
CVSS
0.6%
EPSS
No
On KEV
Description
The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) allows attackers to bypass passkey entry in legacy pairing.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BF
Bm70 Firmware · Microchip
1.43 · source: NVD
BF
Bm71 Firmware · Microchip
1.43 · source: NVD
BF
Bm78 Firmware · Microchip
1.43 · source: NVD
BF
Bm83 Firmware · Microchip
1.43 · source: NVD
IF
Is1870 Firmware · Microchip
1.43 · source: NVD
IF
Is1871 Firmware · Microchip
1.43 · source: NVD
PL
Pic Lightblue Explorer Demo Firmware · Microchip
4.2_dt100112 · source: NVD
RF
Rn4870 Firmware · Microchip
1.43 · source: NVD
RF
Rn4871 Firmware · Microchip
1.43 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-46400
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-46400
Product
https://microchip.com
Exploit
https://www.computer.org/csdl/proceedings-article/sp/2023/933600a521/1He7Yja1AYM
Third Party Advisory
https://www.computer.org/csdl/proceedings/sp/2023/1He7WWuJExG
Vendor Advisory
https://www.microchip.com/en-us/products/wireless-connectivity/software-vulnerability-response/deviating-behaviors-in-bluetooth-le
More from Bm70 Firmware
8.6
CVE-2022-46403
The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) mishandles reject messages
7.5
CVE-2022-46399
The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) is unresponsive with ConReqTimeoutZero
6.5
CVE-2022-46402
The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) accepts PairCon_rmSend with incorrect values
5.4
CVE-2022-46401
The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) accepts PauseEncReqPlainText before pairing is complete