What is the CVSS score of CVE-2023-24023?

CVE-2023-24023 has a CVSS 3.1 base score of 6.8 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 1.3%.

Bluetooth Core Specification CVE-2023-24023

MEDIUM

2023-11-28 cve@mitre.org

Code Injection Bluetooth Core Specification Windows 10 1809 Windows 10 21h2 Windows 10 22h2 Windows 11 21H2 Windows 11 22h2 Windows 11 23h2 Windows Server 2019 Windows Server 2022 Windows Server 2022 23h2

6.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.8 MEDIUM

AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

CVE Published

Nov 28, 2023 - 07:15 nvd

MEDIUM 6.8

DescriptionNVD

AnalysisAI

Technical ContextAI

Bluetooth BR/EDR devices with Secure Simple Pairing and Secure Connections pairing in Bluetooth Core Specification 4.2 through 5.4 allow certain man-in-the-middle attacks that force a short key length, and might lead to discovery of the encryption key and live injection, aka BLUFFS. Affected products include: Bluetooth Bluetooth Core Specification, Microsoft Windows 10 1809, Microsoft Windows 10 21H2, Microsoft Windows 10 22H2, Microsoft Windows 11 21H2. Version information: through 5.4.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.