CVE-2022-25837 - CVE House
Back to Database
Status published Unknown CVE-2022-25837

Bluetooth® Pairing in Bluetooth Core Specification v1.0B through v5.3 may...

Vulnerability Description

Bluetooth® Pairing in Bluetooth Core Specification v1.0B through v5.3 may permit an unauthenticated MITM to acquire credentials with two pairing devices via adjacent access when at least one device supports BR/EDR Secure Connections pairing and the other BR/EDR Legacy PIN code pairing if the MITM negotiates BR/EDR Secure Simple Pairing in Secure Connections mode using the Passkey association model with the pairing Initiator and BR/EDR Legacy PIN code pairing with the pairing Responder and brute forces the Passkey entered by the user into the Responder as a 6-digit PIN code. The MITM attacker can use the identified PIN code value as the Passkey value to complete authentication with the Initiator via Bluetooth pairing method confusion.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-25837

Credits & Attribution

No credits recorded in the NVD database.

References

More from bluetooth

View All →
CVE-2022-25836
Bluetooth® Low Energy Pairing in Bluetooth Core Specification v4.0 through...
Unknown 0
CVE-2022-24695
Bluetooth Classic in Bluetooth Core Specification through 5.3 does not...
Unknown 0
CVE-2021-31615
Unencrypted Bluetooth Low Energy baseband links in Bluetooth Core Specifications...
Medium 5.3
CVE-2020-35473
An information leakage vulnerability in the Bluetooth Low Energy advertisement...
Unknown 0
CVE-2020-26560
Bluetooth Mesh Provisioning in the Bluetooth Mesh profile 1.0 and...
High 8.1

Affected Vendor

Affected Software

bluetooth core specification
Vulnerable Versions:
1.1b

Timeline

Official Publish: December 12th, 2022
Last Modified: April 22nd, 2025
Added to House: July 21st, 2026

CVSS Vectors

No vector data available

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.