EUVD-2026-58080
GHSA-j2wh-vq5f-p4wj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessEnter Bluetooth radio range
-
DeliveryForge unencrypted pause encryption request
-
ExploitTransmit malformed link management message
-
ExecutionBT122 processes unauthenticated control message
-
PersistModule enters unexpected state
-
ImpactDevice availability lost
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Expected behavior violation
|
| Exploitation Conditions | The attacker must be within Bluetooth Classic radio range of the target device - typically 10 to 100 meters depending on antenna class. No authentication, pairing, or prior relationship with the target device is required (CVSS PR:N, UI:N). The target device must have a BT122 module in an active or discoverable Bluetooth state. No non-default configuration is required; the vulnerability exists in the base protocol message handling. Exploitation is limited by physical proximity - the adjacency vector (AV:A) prevents remote internet-based attacks. Devices not exposing Bluetooth Classic (e.g., BLE-only modes if applicable) or those with radio disabled would not be reachable. |
| Impact | The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VA:H) signals a low-complexity, unauthenticated attack confined to Bluetooth radio adjacency (typically 10-100 meters), with no confidentiality or integrity impact - purely a high-severity availability concern. The absence of EPSS data, KEV listing, and any known public exploit code suggests this remains a researcher-disclosed vulnerability without confirmed active exploitation. The attack surface is physically bounded by Bluetooth range, which substantially limits mass exploitation compared to network-vectored vulnerabilities. The DoS-only impact class reduces urgency relative to RCE or data-exfiltration flaws, but in operational technology or medical device contexts where BT122-based hardware is used for critical functions, availability loss may still carry significant operational consequences. CVSS score alignment with the described impact appears accurate - the 7.1 (CVSS 4.0) reflects the adjacency constraint moderating what would otherwise be a higher score. |
| Exploit ScenarioDerived | An attacker within Bluetooth radio range (approximately 10-100 meters) of a device incorporating the BT122 module crafts and transmits a raw, unencrypted 'pause encryption request' Bluetooth Classic link management message. The BT122 module, failing to validate that such a request should only arrive within an encrypted session, processes the message and enters an unexpected state, causing the module - and any dependent device functionality - to become unresponsive. No prior pairing or authentication is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 13, 2026
Denial of service in the Silicon Labs BT122 Bluetooth module is triggered by an adjacent unauthenticated attacker who transmits a forged, unencrypted 'pause encryption request' control message, causing the module to crash or become unresponsive. The flaw, cataloged as vulnerability B-E10 in academic research (arXiv:2409.02905), exploits the module's failure to enforce encryption state validation on incoming link-layer control messages. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; exploitation is bounded by Bluetooth radio adjacency.
RemediationAI
No patch version has been confirmed in the available data; the vendor advisory at https://community.silabs.com/068Vm00000x0Yqy should be consulted for current fix availability and firmware update instructions. As compensating controls, operators should restrict physical Bluetooth radio exposure by deploying BT122-based devices in RF-shielded or physically access-controlled environments to limit attacker adjacency. Where possible, disable or limit Bluetooth discoverability and pairing to known, trusted devices. If the module supports Bluetooth Classic link-layer security policy enforcement, review firmware configuration options to require encrypted sessions before accepting link management protocol messages. Note that these controls reduce attack surface but do not remediate the underlying protocol implementation flaw.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected product is the Silicon Labs BT122 Bluetooth Classic module (CPE: cpe:2.3:a:silabs.com:bt122:*:*:*:*:*:*:*:*). CWE-440 (Expected Behavior Violation) captures the root cause: the Bluetooth link manager in the BT122 processes a 'pause encryption request' message without verifying that the message itself arrives over an encrypted channel, violating the implicit security contract of the Bluetooth Classic protocol. In a properly implemented stack, control messages that govern encryption state transitions should only be accepted within an already-secured session. This is a protocol state machine confusion class of vulnerability - the device accepts an out-of-context message, driving the link manager into an unexpected state that results in a denial-of-service condition. The academic paper at arXiv:2409.02905 appears to systematically enumerate Bluetooth protocol implementation flaws of this class across multiple vendors.
Know when Bt122 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Adjacent Bluetooth vector, no auth or interaction required; impact is availability-only with no scope change, yielding a 6.5 base score.
Primary rating from Vendor (Silabs).
CVSS VectorVendor: Silabs
DescriptionCVE.org
An unencrypted 'pause encryption request' message causes a denial of service in the BT122 module. See vulnerability B-E10 in the related paper below.
Executive ViewAI
Silicon Labs BT122 Bluetooth modules used in your organization are vulnerable to denial-of-service attacks from unauthenticated, adjacent attackers, potentially rendering affected devices unresponsive or crashed. With no patch currently available from Silicon Labs, affected devices require immediate inventory and interim mitigation to maintain availability.
No vendor-released patch identified at time of analysis. Interim mitigations include: reducing Bluetooth transmission range through power/antenna adjustments; segregating affected devices onto isolated network segments; implementing monitoring for anomalous Bluetooth connection activity; and disabling the BT122 radio on devices where Bluetooth functionality is not essential. These controls substantially reduce exposure pending patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Memory disclosure in the Silicon Labs BT122 Bluetooth module allows unauthenticated adjacent attackers to leak potential
Denial of service in the Silicon Labs BT122 Bluetooth module allows any adjacent attacker to permanently stop the module
Exploit-DB