EUVD-2026-58077
GHSA-3j2f-xg4w-894p
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent-only attack vector (Bluetooth range); no auth or user interaction required; impact is solely low availability (advertising halts); no confidentiality or integrity effect; scope unchanged.
Primary rating from Vendor (Silabs).
CVSS VectorVendor: Silabs
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
1DescriptionCVE.org
The BT122 module stops advertising after receiving a plaintext 'pause enceryption response' message resulting in a denial of service. See vulnerability B-E2 in the related paper below.
AnalysisAI
Denial of service in the Silicon Labs BT122 Bluetooth module allows any adjacent attacker to permanently stop the module from advertising by sending a single plaintext 'pause encryption response' message. Documented as vulnerability B-E2 in an academic Bluetooth security paper (arXiv:2409.02905), this flaw causes the device to cease Bluetooth advertising without validation of whether the control message was delivered over an encrypted channel. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must be within Bluetooth radio range (typically up to 10-100 meters depending on module class and environment) - this is a hard physical prerequisite that cannot be bypassed remotely. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VA:L) places the attack in adjacent-network scope - the attacker must be within Bluetooth radio range, which substantially constrains real-world exposure compared to a network-reachable vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker within Bluetooth radio range of a deployed BT122 module crafts and transmits a plaintext 'pause encryption response' LMP message targeted at the module. Upon receipt, the module halts Bluetooth advertising without verifying encryption state, rendering it unreachable to legitimate paired devices or controllers until power-cycled. … |
| Remediation | Consult the Silicon Labs community advisory at https://community.silabs.com/068Vm00000x0Yqy for firmware updates addressing this flaw; the provided data does not confirm an exact patched firmware version, so the advisory must be checked directly. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Denial of service in the Silicon Labs BT122 Bluetooth module is triggered by an adjacent unauthenticated attacker who tr
Memory disclosure in the Silicon Labs BT122 Bluetooth module allows unauthenticated adjacent attackers to leak potential
Same weakness CWE-440 – Expected Behavior Violation
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today