bluez

CVE-2021-3658

MEDIUM 6.5

En bref

Source: NVD
EPSS: EPSS 0.79 % · centile 56 (2026-10-29)
État: PUBLISHED
Publiée: 2022-03-02 22:11 UTC
Mise à jour: 2026-04-15 21:11 UTC
Attribuée par: redhat
Statut NVD: Modified

Rechercher sur…

Description

bluetoothd from bluez incorrectly saves adapters' Discoverable status when a device is powered down, and restores it when powered up. If a device is powered down while discoverable, it will be discoverable when powered on again. This could lead to inadvertent exposure of the bluetooth stack to physically nearby attackers.

Faiblesses (CWE)

CWE-863 — Autorisation incorrecte

Références

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	MEDIUM 6.5	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	CISA-ADP
CVSS 3.1	MEDIUM 6.5	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	NVD · nvd@nist.gov (Primary)
CVSS 3.1	MEDIUM 6.5	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)
CVSS 2.0	LOW 3.3	AV:A/AC:L/Au:N/C:P/I:N/A:N	NVD · nvd@nist.gov (Primary)

Références européennes

ENISA EUVD · EUVD-2021-26953
GCVE · GCVE-0-2021-3658

Configurations affectées (CPE NVD)

cpe:2.3:a:bluez:bluez:*:*:*:*:*:*:*:* < 5.61
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*

Produits affectés

Produit	Versions
bluez	affected Fixedin - 5.61 and above.

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

🟡 bluez