Zephyr RTOS CVE-2026-2411

Exploitation requires all four of the following conditions simultaneously: (1) the target application declares notify or indicate characteristics with BT_GATT_PERM_READ_ENCRYPT, BT_GATT_PERM_READ_AUTHEN, or LESC-required permissions set on the Characteristic Value attribute; (2) the application passes the Characteristic Declaration attribute (not the value attribute) to bt_gatt_notify_cb() or bt_gatt_indicate(), which is the documented and common idiom; (3) the Client Characteristic Configuration descriptor for that characteristic is writable without pairing or at a lower security tier than the characteristic value itself, allowing an unauthenticated peer to enable notifications; and (4) the attacker is physically within Bluetooth radio range of the target device (AV:A). Exploitation is blocked when: applications directly pass the value attribute pointer to the notify/indicate API; when the CCC write requires the same security level as the characteristic value; or when the Bluetooth controller enforces link-layer encryption independently of the host stack. The vulnerability has no effect on characteristics declared without encrypt or authen requirements.

CVSS 6.5 with vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N reflects adjacent-network unauthenticated access with high confidentiality impact, which is accurate for the described flaw. The adjacent attack vector (AV:A) is the primary risk-limiting factor: exploitation requires Bluetooth radio proximity, ruling out internet-scale attacks. No EPSS score was provided in the input. No CISA KEV listing exists and no public exploit or proof-of-concept has been identified, reducing urgency compared to a KEV-listed issue. Real-world exploitability is further constrained by two application-level conditions that must co-exist: the application must declare notify/indicate characteristics with encrypt or authen requirements, and the CCC descriptor must be writable at a lower security tier. In many well-hardened BLE deployments both the characteristic value and its CCC would be gated at the same security level, closing the window. The high confidentiality impact is meaningful only when the protected characteristic carries sensitive data such as health metrics, keys, or proprietary sensor values. There is no integrity or availability impact, and no memory-safety concern.

An attacker with a standard BLE dongle and knowledge of a target device's sensitive characteristic UUID (discoverable via GATT enumeration) connects to the Zephyr device without pairing, writes the Client Characteristic Configuration descriptor to enable notifications, and receives the full characteristic value - such as a health sensor reading or proprietary telemetry - over the unencrypted link. The server emits the data because it evaluated the Characteristic Declaration's unconditional read permission instead of the value's encryption requirement. No public proof-of-concept has been identified, but the attack requires only commodity BLE tooling.