Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2021-21367— Incorrect Authorization in switchboard-plug-bluetooth

Quick assessment

Affected
elementary switchboard-plug-bluetooth
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

DanielForé switchboard-plug-bluetooth是 （DanielForé）开源的一个应用软件。一个配电盘蓝牙插头。 Switchboard Bluetooth 存在安全漏洞，攻击者很可能能够未经授权从此类服务中提取数据。

CVSS 6.1 · Medium EPSS 0.51% · P42
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2021-21367

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Incorrect Authorization in switchboard-plug-bluetooth
Source: CVE Program / CVE List V5
Vulnerability Description
Switchboard Bluetooth Plug for elementary OS from version 2.3.0 and before version version 2.3.5 has an incorrect authorization vulnerability. When the Bluetooth plug is running (in discoverable mode), Bluetooth service requests and pairing requests are automatically accepted, allowing physically proximate attackers to pair with a device running an affected version of switchboard-plug-bluetooth without the active consent of the user. By default, elementary OS doesn't expose any services via Bluetooth that allow information to be extracted by paired Bluetooth devices. However, if such services (i.e. contact list sharing software) have been installed, it's possible that attackers have been able to extract data from such services without authorization. If no such services have been installed, attackers are only able to pair with a device running an affected version without authorization and then play audio out of the device or possibly present a HID device (keyboard, mouse, etc...) to control the device. As such, users should check the list of trusted/paired devices and remove any that are not 100% confirmed to be genuine. This is fixed in version 2.3.5. To reduce the likelihood of this vulnerability on an unpatched version, only open the Bluetooth plug for short intervals when absolutely necessary and preferably not in crowded public areas. To mitigate the risk entirely with unpatched versions, do not open the Bluetooth plug within switchboard at all, and use a different method for pairing devices if necessary (e.g. `bluetoothctl` CLI).
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5
Vulnerability Title
DanielForé switchboard-plug-bluetooth 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
DanielForé switchboard-plug-bluetooth是 （DanielForé）开源的一个应用软件。一个配电盘蓝牙插头。 Switchboard Bluetooth 存在安全漏洞，攻击者很可能能够未经授权从此类服务中提取数据。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
elementary switchboard-plug-bluetooth >= 2.3.0, < 2.3.5 -

II. Public POCs for CVE-2021-21367

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2021-21367

请登录查看更多情报信息。

Patches & Fixes for CVE-2021-21367 (1)

Vendor Advisories for CVE-2021-21367 (1)

Mailing List Discussions for CVE-2021-21367 (3)

Other References for CVE-2021-21367 (1)

IV. Related Vulnerabilities

Same weakness: CWE-863

V. Comments for CVE-2021-21367

No comments yet

Leave a comment