CVE-2019-19196

Severity Score

6.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

The Bluetooth Low Energy Secure Manager Protocol (SMP) implementation on Telink Semiconductor BLE SDK versions before November 2019 for TLSR8x5x through 3.4.0, TLSR823x through 1.3.0, and TLSR826x through 3.3 devices accepts a pairing request with a key size greater than 16 bytes, allowing an attacker in radio range to cause a buffer overflow and denial of service (crash) via crafted packets.

La implementación del Secure Manager Protocol (SMP) de Bluetooth Low Energy en Telink Semiconductor BLE SDK versiones anteriores a noviembre de 2019 para los dispositivos TLSR8x5x versiones hasta 3.4.0, TLSR823x versiones hasta 1.3.0 y TLSR826x versiones hasta 3.3, acepta una petición de emparejamiento con un tamaño de clave superior a 16 bytes , permitiendo a un atacante dentro del radio de alcance causar un desbordamiento del búfer y una denegación de servicio (bloqueo) por medio de paquetes diseñados.

*Credits: N/A

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Attack Vector

Adjacent

Attack Complexity

Low

Authentication

None

Confidentiality

None

Integrity

None

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2019-11-21 CVE Reserved
2020-02-12 CVE Published
2023-03-08 EPSS Updated
2024-08-05 CVE Updated
2024-08-05 First Exploit
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CAPEC

References (2)

URL	Tag	Source

URL	Date	SRC
https://asset-group.github.io/disclosures/sweyntooth	2024-08-05

URL	Date	SRC

URL	Date	SRC
http://www.telink-semi.com/ble	2020-02-25

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Telink-semi Search vendor "Telink-semi"	Tlsr8258 Ble Sdk Search vendor "Telink-semi" for product "Tlsr8258 Ble Sdk"	<= 3.4.0 Search vendor "Telink-semi" for product "Tlsr8258 Ble Sdk" and version " <= 3.4.0"	-	Affected	in	Telink-semi Search vendor "Telink-semi"	Tlsr8258 Search vendor "Telink-semi" for product "Tlsr8258"	-	-	Safe
Telink-semi Search vendor "Telink-semi"	Tlsr8269 Ble Sdk Search vendor "Telink-semi" for product "Tlsr8269 Ble Sdk"	<= 3.3 Search vendor "Telink-semi" for product "Tlsr8269 Ble Sdk" and version " <= 3.3"	-	Affected	in	Telink-semi Search vendor "Telink-semi"	Tlsr8269 Search vendor "Telink-semi" for product "Tlsr8269"	-	-	Safe
Telink-semi Search vendor "Telink-semi"	Tlsr8253 Ble Sdk Search vendor "Telink-semi" for product "Tlsr8253 Ble Sdk"	<= 3.4.0 Search vendor "Telink-semi" for product "Tlsr8253 Ble Sdk" and version " <= 3.4.0"	-	Affected	in	Telink-semi Search vendor "Telink-semi"	Tlsr8253 Search vendor "Telink-semi" for product "Tlsr8253"	-	-	Safe
Telink-semi Search vendor "Telink-semi"	Tlsr8251 Ble Sdk Search vendor "Telink-semi" for product "Tlsr8251 Ble Sdk"	<= 3.4.0 Search vendor "Telink-semi" for product "Tlsr8251 Ble Sdk" and version " <= 3.4.0"	-	Affected	in	Telink-semi Search vendor "Telink-semi"	Tlsr8251 Search vendor "Telink-semi" for product "Tlsr8251"	-	-	Safe
Telink-semi Search vendor "Telink-semi"	Tlsr8232 Ble Sdk Search vendor "Telink-semi" for product "Tlsr8232 Ble Sdk"	<= 1.3.0 Search vendor "Telink-semi" for product "Tlsr8232 Ble Sdk" and version " <= 1.3.0"	-	Affected	in	Telink-semi Search vendor "Telink-semi"	Tlsr8232 Search vendor "Telink-semi" for product "Tlsr8232"	-	-	Safe