Silicon Labs BT122 CVE-2026-65933

Exploitation requires the attacker to be within Bluetooth radio range of the BT122 device (adjacent network vector, AV:A) - typically 10-100 meters depending on Bluetooth power class. No authentication or credentials are required (PR:N per the provided CVSS 4.0 vector), and no user interaction is needed (UI:N). The only trigger is a malformed Bluetooth connection request message, which any Bluetooth-capable device can generate. No non-default configuration is specified as a prerequisite. Exploitation is limited by: (1) physical proximity constraint of Bluetooth radio range, (2) the need to target a specific BT122 device rather than broad internet scanning, and (3) the sensitivity of data actually present in device memory at the time of the over-read, which varies by application.

The CVSS 4.0 score of 5.3 with AV:A accurately reflects the primary risk constraint: exploitation requires physical proximity within Bluetooth radio range, typically 10-100 meters depending on device class. AC:L and PR:N indicate no special configuration or authentication barriers, making the attack straightforward for any Bluetooth-capable device. However, the provided CVSS 4.0 vector maps the impact to VI:L (Integrity) rather than VC:L (Confidentiality), which is inconsistent with the described behavior of leaking sensitive information - an information disclosure finding would conventionally map to a Confidentiality impact; this metric discrepancy should be verified with Silicon Labs. No EPSS score is available, and the absence of a KEV listing combined with academic-paper origin suggests research disclosure rather than active threat-actor exploitation. The CPE wildcard version ('*') implies all BT122 firmware versions are potentially affected, but no confirmed version range is available from the advisory. Real-world priority is moderate for environments using BT122 in security-sensitive applications; general IoT deployments with no sensitive in-memory data face lower effective risk.

An attacker with a Bluetooth-capable laptop or single-board computer positions themselves within radio range of a deployed BT122 module and transmits a specially crafted malformed connection request packet using standard Bluetooth tooling. The BT122 firmware's parser reads beyond its intended buffer boundary and returns memory contents in its response, which the attacker captures. No credentials, pairing authorization, or victim interaction are required, and the operation can be repeated to gather additional memory regions.