CVE-2022-25836: bluetooth bluetooth_core_specification Authentication Bypass by Capture-replay

Vulnerability summary

CVE-2022-25836 is a high (CVSS 7.5) Authentication Bypass by Capture-replay vulnerability in bluetooth bluetooth_core_specification. EPSS estimates a 0.37% chance of exploitation in the next 30 days, higher than 29% of scored vulnerabilities.

Timeline

1. 12-12-2022
   PublishedVulnerability first disclosed.
2. 22-04-2025
   Last modifiedVulnerability information updated.

Description

Bluetooth® Low Energy Pairing in Bluetooth Core Specification v4.0 through v5.3 may permit an unauthenticated MITM to acquire credentials with two pairing devices via adjacent access when the MITM negotiates Legacy Passkey Pairing with the pairing Initiator and Secure Connections Passkey Pairing with the pairing Responder and brute forces the Passkey entered by the user into the Initiator. The MITM attacker can use the identified Passkey value to complete authentication with the Responder via Bluetooth pairing method confusion.

• CWE-294Authentication Bypass by Capture-replayA capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).