CVE-2019-9506 - CVE House

Back to Database

Status published High CVE-2019-9506

Blutooth BR/EDR specification does not specify sufficient encryption key length and allows an attacker to influence key length negotiation

7.6 CVSS

Vulnerability Description

The Bluetooth BR/EDR specification up to and including version 5.1 permits sufficiently low encryption key length and does not prevent an attacker from influencing the key length negotiation. This allows practical brute-force attacks (aka "KNOB") that can decrypt traffic and inject arbitrary ciphertext without the victim noticing.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-9506

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Daniele Antonioli‚ Nils Ole Tippenhauer, Kasper Rasmussen

References

More from Bluetooth

View All →

Bluetooth devices supporting BR/EDR v5.2 and earlier are vulnerable to impersonation attacks

Bluetooth devices supporting LE and specific BR/EDR implementations are vulnerable to method confusion attacks

Affected Vendor

Bluetooth

View all reports →

Affected Software

BR/EDR

Vulnerable Versions:

5.1

Timeline

Official Publish: August 14th, 2019

Last Modified: September 16th, 2024

Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Weaknesses (CWE)

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.