Risk | Low |
Patch available | NO |
Number of vulnerabilities | 1 |
CVE-ID | N/A |
CWE-ID | CWE-319 |
Exploitation vector | Local |
Public exploit | N/A |
Vulnerable software Subscribe |
BCM20702 Hardware solutions / Firmware |
Vendor | Broadcom |
Security Bulletin
This security bulletin contains one low risk vulnerability.
EUVDB-ID: #VU22622
Risk: Low
CVSSv3.1: 2 [CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:U/RC:C]
CVE-ID: N/A
CWE-ID:
CWE-319 - Cleartext Transmission of Sensitive Information
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to software firmware does not use encryption during communication via Bluetooth protocol. An attacker with physical proximity to the device can intercept network traffic can gain access to sensitive data, (e.g. perform a person-in-the-middle attack).
MitigationCybersecurity Help is currently unaware of any official solution to address this vulnerability.
Please, contact your hardware vendor to obtain patches.
BCM20702: All versions
External linkshttp://lists.opensuse.org/opensuse-security-announce/2019-11/msg00025.html
Q & A
Can this vulnerability be exploited remotely?
No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.