Silicon Labs BT122 CVE-2026-65932

The attacker must be within Bluetooth radio range (typically up to 10-100 meters depending on module class and environment) - this is a hard physical prerequisite that cannot be bypassed remotely. No authentication or pairing is required; the plaintext message is accepted by the module regardless of session encryption state. The vulnerability triggers on receipt of a 'pause encryption response' LMP message delivered without encryption, which is the specific abnormal condition the module fails to reject. Exploitation is limited to availability impact only (module stops advertising); no data exfiltration or code execution is possible through this vector. The attack requires no special privileges and no user interaction on the victim device.

The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VA:L) places the attack in adjacent-network scope - the attacker must be within Bluetooth radio range, which substantially constrains real-world exposure compared to a network-reachable vulnerability. Impact is limited to low availability (the module stops advertising) with no confidentiality or integrity consequence. EPSS data was not provided, and the vulnerability is absent from CISA KEV, suggesting no confirmed active exploitation. The academic paper origin indicates responsible-disclosure research rather than criminal weaponization. For most enterprise environments this is a low-to-medium operational priority; deployments where BT122 modules serve safety-critical or continuously-available functions - such as industrial sensor networks or medical telemetry - should treat the physical proximity requirement as the primary control surface and assess whether Bluetooth range can be physically restricted. The CVSS score of 5.3 is consistent with the actual impact: a proximity-constrained, availability-only DoS with no data exposure.

An attacker within Bluetooth radio range of a deployed BT122 module crafts and transmits a plaintext 'pause encryption response' LMP message targeted at the module. Upon receipt, the module halts Bluetooth advertising without verifying encryption state, rendering it unreachable to legitimate paired devices or controllers until power-cycled. The academic paper arXiv:2409.02905 documents the technique as B-E2, indicating the attack mechanism is publicly described in research literature, though no standalone weaponized tool has been identified.