EUVD-2026-58080
GHSA-j2wh-vq5f-p4wj
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent Bluetooth vector, no auth or interaction required; impact is availability-only with no scope change, yielding a 6.5 base score.
Primary rating from Vendor (Silabs).
CVSS VectorVendor: Silabs
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
An unencrypted 'pause encryption request' message causes a denial of service in the BT122 module. See vulnerability B-E10 in the related paper below.
AnalysisAI
Denial of service in the Silicon Labs BT122 Bluetooth module is triggered by an adjacent unauthenticated attacker who transmits a forged, unencrypted 'pause encryption request' control message, causing the module to crash or become unresponsive. The flaw, cataloged as vulnerability B-E10 in academic research (arXiv:2409.02905), exploits the module's failure to enforce encryption state validation on incoming link-layer control messages. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must be within Bluetooth Classic radio range of the target device - typically 10 to 100 meters depending on antenna class. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VA:H) signals a low-complexity, unauthenticated attack confined to Bluetooth radio adjacency (typically 10-100 meters), with no confidentiality or integrity impact - purely a high-severity availability concern. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker within Bluetooth radio range (approximately 10-100 meters) of a device incorporating the BT122 module crafts and transmits a raw, unencrypted 'pause encryption request' Bluetooth Classic link management message. The BT122 module, failing to validate that such a request should only arrive within an encrypted session, processes the message and enters an unexpected state, causing the module - and any dependent device functionality - to become unresponsive. … |
| Remediation | No patch version has been confirmed in the available data; the vendor advisory at https://community.silabs.com/068Vm00000x0Yqy should be consulted for current fix availability and firmware update instructions. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all devices and products in your infrastructure using Silicon Labs BT122 modules, including IoT devices, wireless peripherals, and industrial equipment, and document their business criticality. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Memory disclosure in the Silicon Labs BT122 Bluetooth module allows unauthenticated adjacent attackers to leak potential
Denial of service in the Silicon Labs BT122 Bluetooth module allows any adjacent attacker to permanently stop the module
Same weakness CWE-440 – Expected Behavior Violation
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today