CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-11957
https://notcve.org/view.php?id=CVE-2020-11957
The Bluetooth Low Energy implementation in Cypress PSoC Creator BLE 4.2 component versions before 3.64 generates a random number (Pairing Random) with significantly less entropy than the specified 128 bits during BLE pairing. This is the case for both authenticated and unauthenticated pairing with both LE Secure Connections as well as LE Legacy Pairing. A predictable or brute-forceable random number allows an attacker (in radio range) to perform a MITM attack during BLE pairing. La implementación de Bluetooth Low Energy en el componente Cypress PSoC Creator BLE 4.2 versiones anteriores a 3.64, genera un número aleatorio (Pairing Random) con significativamente menos entropía que los 128 bits especificados durante el emparejamiento BLE. Este es el caso tanto para el emparejamiento autenticado como para el autenticado con LE Secure Connections y LE Legacy Pairing. • https://www.cypress.com/file/504466/download • CWE-331: Insufficient Entropy •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2019-17061
https://notcve.org/view.php?id=CVE-2019-17061
The Bluetooth Low Energy (BLE) stack implementation on Cypress PSoC 4 through 3.62 devices does not properly restrict the BLE Link Layer header and executes certain memory contents upon receiving a packet with a Link Layer ID (LLID) equal to zero. This allows attackers within radio range to cause deadlocks, cause anomalous behavior in the BLE state machine, or trigger a buffer overflow via a crafted BLE Link Layer frame. La implementación de la pila de Bluetooth Low Energy (BLE) en dispositivos Cypress PSoC 4 versiones hasta 3.62, no restringe apropiadamente el encabezado BLE Link Layer y ejecuta determinados contenidos de memoria tras recibir un paquete con un Link Layer ID (LLID) igual a cero. Esto permite a atacantes dentro del radio de alcance causar puntos muertos, causar un comportamiento anómalo en la máquina de estado BLE o desencadenar un desbordamiento del búfer por medio de una trama BLE Link Layer diseñada. • https://asset-group.github.io/disclosures/sweyntooth https://community.cypress.com/thread/53680 https://www.cypress.com/products/ble-bluetooth • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •