CVE-2021-40526 - CVE House
Back to Database
Status published Medium CVE-2021-40526

Incorrect calculation of buffer size vulnerability in Peleton TTR01 up...

Vulnerability Description

Incorrect calculation of buffer size vulnerability in Peleton TTR01 up to and including PTV55G allows a remote attacker to trigger a Denial of Service attack through the GymKit daemon process by exploiting a heap overflow in the network server handling the Apple GymKit communication. This can lead to an Apple MFI device not being able to authenticate with the Peleton Bike

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-40526

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Mark Bereza from McAfee Enterprise ATR

References

More from onepeloton

View All →
CVE-2021-40527
Exposure of senstive information to an unauthorised actor in the...
High 8.6
CVE-2021-33887
Insufficient verification of data authenticity in Peloton TTR01 up to...
Medium 6.8

Affected Vendor

Affected Software

ttr01 firmware
Vulnerable Versions:
0

Timeline

Official Publish: October 25th, 2021
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.