CVE-2018-10910: bluez Incorrect Authorization
Vulnerability summary
CVE-2018-10910 is a medium (CVSS 4.5) Incorrect Authorization vulnerability in bluez. EPSS estimates a 0.46% chance of exploitation in the next 30 days, higher than 39.8% of scored vulnerabilities. 1 public exploit is recorded.
Not severe (CVSS 4.5, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 1Timeline
- 28-01-2019PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
A bug in Bluez may allow for the Bluetooth Discoverable state being set to on when no Bluetooth agent is registered with the system. This situation could lead to the unauthorized pairing of certain Bluetooth devices without any form of authentication. Versions before bluez 5.51 are vulnerable.
CVSS metrics
6 scores · 5 sources · 2 versions- NVDNIST3.3LowCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NDiffers
- OSV · Red hatEcosystem advisory · calculated4.5MediumCVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
- OSV · UbuntuEcosystem advisory · calculated4.5MediumCVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
- OSV · DebianEcosystem advisory · calculated3.3LowCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NDiffers
EPSS trend
Probability
0.46%
Chance of exploitation in the next 30 days
Percentile
40%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.46% on 05-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (bugzilla.redhat.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: local access, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat12 products
- bluez< 0:5.44-6.el7 | < 0:5.50-3.el8
- bluez-cups< 0:5.44-6.el7 | < 0:5.50-3.el8
- bluez-cups-debuginfo< 0:5.50-3.el8
- bluez-debuginfo< 0:5.44-6.el7 | < 0:5.50-3.el8
- bluez-debugsource< 0:5.50-3.el8
Ubuntu2 products
- bluezAll versions (No fix recorded)
- gnome-bluetooth< 3.28.0-2ubuntu0.1
Bluez1 product
- bluez< 5.51
Canonical1 product
- ubuntu_linuxEOL18.04
Debian1 product
- bluez< 5.54-1
The bluez project1 product
- bluez< 5.51
6 vendors · 18 products
References
16 links- bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10910X Refsource CONFIRMExploitIssue TrackingPatchThird Party Advisory
