Esp Idf
Monthly
Denial of service in Espressif's ESP-IDF JPEG driver (versions 6.0.1, 5.5.4, 5.4.4, 5.3.5 and likely earlier) stems from an out-of-bounds stack write in jpeg_parse_dqt_marker(), where the attacker-controlled DQT marker Tq nibble indexes the qt_tbl array without a 0..3 bounds check. Any application that feeds untrusted JPEG data into the hardware JPEG decode path can be reliably crashed by a single malformed image. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the vendor has released a fix in 6.0.2 with backports pending for the 5.x branches.
Heap buffer overflow in Espressif ESP-IDF's protocomm component allows adjacent-network attackers to corrupt heap memory during the SRP6a (Security Scheme 2) session-setup handshake on affected IoT devices running ESP-IDF 5.2.6, 5.3.5, 5.4.4, 5.5.4, or 6.0. The flaw stems from a type-width mismatch in handle_session_command0() that trusts the client-supplied protobuf username length, enabling denial of service and potential integrity impact on provisioning interfaces. No public exploit identified at time of analysis; patches are available in 5.2.7, 5.3.6, 5.4.5, 5.5.5, and 6.0.1.
Privilege escalation from REE to TEE in Espressif ESP-IDF 5.5.4 and 6.0 lets a low-privileged user-application caller abuse esp_tee secure-service wrappers (AES, SHA, ECC, HMAC, SPI, MMU, WDT, attestation, OTA, secure storage) due to insufficient buffer-range validation in esp_secure_services.c and esp_secure_services_iram.c. EPSS is 0.02% and there is no public exploit identified at time of analysis, but technical impact is total because the flaw lets REE code reach TEE-protected hardware peripherals and security services.
Remote denial-of-service in Espressif ESP-IDF's esp_http_server WebSocket handshake allows unauthenticated attackers to crash IoT devices by sending a malformed Sec-WebSocket-Protocol header. The flaw (CWE-476 NULL-pointer dereference) is triggered pre-authentication during subprotocol negotiation and affects ESP-IDF 5.2.6, 5.3.5, 5.4.4, 5.5.4, and 6.0; no public exploit identified at time of analysis, though upstream commits disclose the exact vulnerable code path.
An out-of-bounds read in the ESP-IDF BlueDroid L2CAP configuration-option parser lets an unauthenticated Bluetooth BR/EDR peer within radio range send a malformed configuration request that reads past the end of the received packet, and under some runtime conditions limited adjacent Bluetooth stack memory can be echoed back in an outbound L2CAP Configuration Response. Only ESP32-class devices built with the BlueDroid host stack and Classic Bluetooth (BR/EDR) enabled are affected; builds using the NimBLE stack or with Classic Bluetooth disabled are not exposed. Assessed as CVSS 3.1 6.5 (Medium, AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L), with no public exploit identified at time of analysis and no confirmed active exploitation - a genuine but moderate-priority issue rather than an emergency, addressed in 5.2.8, 5.3.6, 5.5.5, 6.0.3, and 6.1-rc1.
An out-of-bounds heap read in Espressif ESP-IDF's BlueDroid A2DP sink path (btc_a2dp_sink_handle_inc_media()) affects versions 5.5.5, 6.0.1, and 6.1 on builds where Classic Bluetooth (BR/EDR) and A2DP sink support are explicitly enabled. A paired BR/EDR audio source within Bluetooth radio range can send a malformed A2DP media packet whose layout omits the timestamp field, causing the sink to read a UINT32 past the valid buffer and leak limited adjacent heap contents (CVSS 4.3, AV:A/AC:L/PR:N/UI:N/C:L/I:N/A:N). There is no CISA KEV listing and no public exploit identified at time of analysis, and the reporter explicitly states that arbitrary memory disclosure and code execution are not established, despite third-party tags implying RCE.
Out-of-bounds read in ESP-IDF's BlueDroid AVRCP vendor-command parser allows adjacent Bluetooth attackers with low privileges to leak device memory and degrade availability across multiple ESP-IDF stable branches. Versions 5.2.6, 5.3.5, 5.4.4, 5.5.3, and 6.0 are confirmed affected via the Espressif GitHub security advisory. The parser's failure to validate payload length before dereferencing the buffer pointer enables a malformed AVRCP vendor command to read beyond allocated memory, yielding partial confidentiality loss and potential stack instability. No public exploit code exists and this CVE is not in CISA KEV at time of analysis.
Information disclosure in Espressif ESP-IDF 5.5.4 and 6.0 allows local code in the Rich Execution Environment (REE) to leak TEE-protected memory by passing crafted pointer arguments to ESP-TEE secure-service wrappers. Because TEE hardware peripherals (ECC, SHA, SPI) run in RISC-V M-mode with full address-space access, attackers can coerce them to read from TEE-exclusive memory and return raw bytes, computed functions, or single-bit oracles enabling incremental disclosure of sensitive material. No public exploit identified at time of analysis; vendor-released patches exist in 5.5.5 and 6.0.1.
Out-of-bounds read in ESP-IDF's embedded DHCP server crashes or exposes heap memory on ESP32 devices operating in SoftAP or DHCP server mode. The `parse_options()` function in the bundled lwIP DHCP server component walks BOOTP/DHCP option TLV fields without validating that each option's declared length stays within the received packet buffer, allowing an adjacent-network unauthenticated attacker to trigger a device crash by sending a single crafted DHCP request. Five active release branches are affected (5.2.x through 6.0.x); vendor-released patches are available across all branches. No public exploit code or CISA KEV listing has been identified at time of analysis.
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. [CVSS 6.3 MEDIUM]
Out-of-bounds read in ESP-IDF versions 5.1.6 through 5.5.2 allows remote attackers to trigger memory corruption via malformed BLE prepare-write requests during device provisioning mode. An unauthenticated BLE client can exploit improper length tracking in the protocomm_ble transport to cause the provisioning handler to read beyond allocated buffer boundaries. This results in potential information disclosure and denial of service for affected IoT devices.
Espressif IoT Development Framework versions 5.1.6-5.5.2 contain a use-after-free vulnerability in the BLE provisioning layer that allows remote attackers to trigger memory corruption when provisioning is stopped with keep_ble_on enabled. A connected BLE client can exploit freed GATT metadata through read/write callbacks to cause denial of service or potential code execution. Patches are available for all affected versions.
An out-of-bounds write in the BlueDroid AVRCP implementation of Espressif's ESP-IDF (avrc_vendor_msg) allows an attacker within Bluetooth Classic radio range to corrupt memory on affected ESP32-class devices, potentially causing crashes, undefined behavior, or controlled memory modification. The flaw affects ESP-IDF 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6 and earlier, but only firmware that actually uses the BlueDroid Bluetooth Classic host stack with the AVRCP profile active and that constructs or passes through vendor-dependent AVRCP commands with a large vendor_len; the CVE carries a CVSS 4.0 base score of 6.1 (AV:A/AC:L/AT:P/PR:N/UI:N) from the GitHub advisory, and an independent mapping to CVSS 3.1 (AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H) rates it moderate rather than critical because exploitation is proximity-bound and profile-dependent. No public exploit code has been identified at time of analysis, and vendor fixes are available through upstream commits referenced in GitHub advisory GHSA-43gh-7r4f-qp57. Note that the vulnerability's impact is worst on builds where assertions are disabled, since the original length check was implemented as an assert; mitigation is an update, not a configuration change, for devices that require AVRCP.
Out-of-bounds write in the BlueDroid Bluetooth host stack shipped with Espressif ESP-IDF 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6 and earlier allows a nearby attacker-controlled Bluetooth Classic device to corrupt memory on a target during SDP service discovery. The flaw is unauthenticated and requires only Bluetooth radio proximity (assessed CVSS:3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H), because a peer advertising more than 32 service UUIDs overflows the fixed-size uuid_list[32][MAX_UUID_SIZE] buffer in bta_dm_sdp_result(). No public exploit has been identified at time of analysis; upstream fixes are already committed and documented in GitHub advisory GHSA-hmjj-rjvv-w8pq.
Out-of-bounds read in Espressif ESP-IDF's Bluetooth AVRCP implementation can disclose limited memory contents or crash an affected ESP32 device when a connected peer sends a malformed VENDOR DEPENDENT command. ESP-IDF 5.1.6, 5.2.6, 5.3.4, 5.4.3, and 5.5.1 and earlier are affected when AVRCP is enabled; the independent assessment limits exposure to Bluetooth-adjacent attackers with an established AVRCP connection rather than internet-reachable systems. No public exploit was identified at time of analysis, EPSS is 0.08% (23rd percentile), and vendor fixes are available.
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. Rated medium severity (CVSS 5.2), this vulnerability is no authentication required, low attack complexity. This Buffer Copy without Size Check vulnerability could allow attackers to overflow a buffer to corrupt adjacent memory.
A security vulnerability in the ESP-NOW protocol implementation within the ESP Wi-Fi component of (CVSS 9.8). Critical severity with potential for significant impact on affected systems. Vendor patch is available.
Espressif Esp idf v5.3.0 is vulnerable to Insecure Permissions resulting in Authentication bypass. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue in Espressif Esp idf v5.3.0 allows attackers to cause a Denial of Service (DoS) via a crafted data channel packet. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Buffer Overflow vulnerability in esp-idf v.5.1 allows a remote attacker to obtain sensitive information via the externalId component. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Buffer Overflow vulnerability in esp-idf v.5.1 allows a remote attacker to execute arbitrary code via a crafted script to the Bluetooth stack component. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
ESP-IDF is the development framework for Espressif SoCs supported on Windows, Linux and macOS. Rated medium severity (CVSS 5.7), this vulnerability is no authentication required.
ESP-IDF is the official development framework for Espressif SoCs. Rated high severity (CVSS 8.8), this vulnerability is no authentication required, low attack complexity. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.
The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly restrict the Feature Page upon reception of an LMP Feature Response Extended packet, allowing attackers in. Rated high severity (CVSS 8.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly handle the reception of multiple LMP IO Capability Request packets during the pairing process, allowing. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly handle the reception of continuous unsolicited LMP responses, allowing attackers in radio range to trigger. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
The Bluetooth Low Energy (BLE) controller implementation in Espressif ESP-IDF 4.0 through 4.2 (for ESP32 devices) returns the wrong number of completed BLE packets and triggers a reachable assertion. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
The Bluetooth Low Energy (BLE) controller implementation in Espressif ESP-IDF 4.2 and earlier (for ESP32 devices) does not properly restrict the channel map field of the connection request packet on. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
An encryption-bypass issue was discovered on Espressif ESP-IDF devices through 4.2, ESP8266_NONOS_SDK devices through 3.0.3, and ESP8266_RTOS_SDK devices through 3.3. Rated medium severity (CVSS 6.8), this vulnerability is no authentication required. Public exploit code available and no vendor patch available.
An issue was discovered in Espressif ESP-IDF 2.x, 3.0.x through 3.0.9, 3.1.x through 3.1.6, 3.2.x through 3.2.3, and 3.3.x through 3.3.1. Rated medium severity (CVSS 6.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
The EAP peer implementation in Espressif ESP-IDF 2.0.0 through 4.0.0 and ESP8266_NONOS_SDK 2.2.0 through 3.1.0 processes EAP Success messages before any EAP method completion or failure, which allows. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The EAP peer implementation in Espressif ESP-IDF 2.0.0 through 4.0.0 and ESP8266_NONOS_SDK 2.2.0 through 3.1.0 allows the installation of a zero Pairwise Master Key (PMK) after the completion of any. Rated high severity (CVSS 8.1), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
Denial of service in Espressif's ESP-IDF JPEG driver (versions 6.0.1, 5.5.4, 5.4.4, 5.3.5 and likely earlier) stems from an out-of-bounds stack write in jpeg_parse_dqt_marker(), where the attacker-controlled DQT marker Tq nibble indexes the qt_tbl array without a 0..3 bounds check. Any application that feeds untrusted JPEG data into the hardware JPEG decode path can be reliably crashed by a single malformed image. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the vendor has released a fix in 6.0.2 with backports pending for the 5.x branches.
Heap buffer overflow in Espressif ESP-IDF's protocomm component allows adjacent-network attackers to corrupt heap memory during the SRP6a (Security Scheme 2) session-setup handshake on affected IoT devices running ESP-IDF 5.2.6, 5.3.5, 5.4.4, 5.5.4, or 6.0. The flaw stems from a type-width mismatch in handle_session_command0() that trusts the client-supplied protobuf username length, enabling denial of service and potential integrity impact on provisioning interfaces. No public exploit identified at time of analysis; patches are available in 5.2.7, 5.3.6, 5.4.5, 5.5.5, and 6.0.1.
Privilege escalation from REE to TEE in Espressif ESP-IDF 5.5.4 and 6.0 lets a low-privileged user-application caller abuse esp_tee secure-service wrappers (AES, SHA, ECC, HMAC, SPI, MMU, WDT, attestation, OTA, secure storage) due to insufficient buffer-range validation in esp_secure_services.c and esp_secure_services_iram.c. EPSS is 0.02% and there is no public exploit identified at time of analysis, but technical impact is total because the flaw lets REE code reach TEE-protected hardware peripherals and security services.
Remote denial-of-service in Espressif ESP-IDF's esp_http_server WebSocket handshake allows unauthenticated attackers to crash IoT devices by sending a malformed Sec-WebSocket-Protocol header. The flaw (CWE-476 NULL-pointer dereference) is triggered pre-authentication during subprotocol negotiation and affects ESP-IDF 5.2.6, 5.3.5, 5.4.4, 5.5.4, and 6.0; no public exploit identified at time of analysis, though upstream commits disclose the exact vulnerable code path.
An out-of-bounds read in the ESP-IDF BlueDroid L2CAP configuration-option parser lets an unauthenticated Bluetooth BR/EDR peer within radio range send a malformed configuration request that reads past the end of the received packet, and under some runtime conditions limited adjacent Bluetooth stack memory can be echoed back in an outbound L2CAP Configuration Response. Only ESP32-class devices built with the BlueDroid host stack and Classic Bluetooth (BR/EDR) enabled are affected; builds using the NimBLE stack or with Classic Bluetooth disabled are not exposed. Assessed as CVSS 3.1 6.5 (Medium, AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L), with no public exploit identified at time of analysis and no confirmed active exploitation - a genuine but moderate-priority issue rather than an emergency, addressed in 5.2.8, 5.3.6, 5.5.5, 6.0.3, and 6.1-rc1.
An out-of-bounds heap read in Espressif ESP-IDF's BlueDroid A2DP sink path (btc_a2dp_sink_handle_inc_media()) affects versions 5.5.5, 6.0.1, and 6.1 on builds where Classic Bluetooth (BR/EDR) and A2DP sink support are explicitly enabled. A paired BR/EDR audio source within Bluetooth radio range can send a malformed A2DP media packet whose layout omits the timestamp field, causing the sink to read a UINT32 past the valid buffer and leak limited adjacent heap contents (CVSS 4.3, AV:A/AC:L/PR:N/UI:N/C:L/I:N/A:N). There is no CISA KEV listing and no public exploit identified at time of analysis, and the reporter explicitly states that arbitrary memory disclosure and code execution are not established, despite third-party tags implying RCE.
Out-of-bounds read in ESP-IDF's BlueDroid AVRCP vendor-command parser allows adjacent Bluetooth attackers with low privileges to leak device memory and degrade availability across multiple ESP-IDF stable branches. Versions 5.2.6, 5.3.5, 5.4.4, 5.5.3, and 6.0 are confirmed affected via the Espressif GitHub security advisory. The parser's failure to validate payload length before dereferencing the buffer pointer enables a malformed AVRCP vendor command to read beyond allocated memory, yielding partial confidentiality loss and potential stack instability. No public exploit code exists and this CVE is not in CISA KEV at time of analysis.
Information disclosure in Espressif ESP-IDF 5.5.4 and 6.0 allows local code in the Rich Execution Environment (REE) to leak TEE-protected memory by passing crafted pointer arguments to ESP-TEE secure-service wrappers. Because TEE hardware peripherals (ECC, SHA, SPI) run in RISC-V M-mode with full address-space access, attackers can coerce them to read from TEE-exclusive memory and return raw bytes, computed functions, or single-bit oracles enabling incremental disclosure of sensitive material. No public exploit identified at time of analysis; vendor-released patches exist in 5.5.5 and 6.0.1.
Out-of-bounds read in ESP-IDF's embedded DHCP server crashes or exposes heap memory on ESP32 devices operating in SoftAP or DHCP server mode. The `parse_options()` function in the bundled lwIP DHCP server component walks BOOTP/DHCP option TLV fields without validating that each option's declared length stays within the received packet buffer, allowing an adjacent-network unauthenticated attacker to trigger a device crash by sending a single crafted DHCP request. Five active release branches are affected (5.2.x through 6.0.x); vendor-released patches are available across all branches. No public exploit code or CISA KEV listing has been identified at time of analysis.
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. [CVSS 6.3 MEDIUM]
Out-of-bounds read in ESP-IDF versions 5.1.6 through 5.5.2 allows remote attackers to trigger memory corruption via malformed BLE prepare-write requests during device provisioning mode. An unauthenticated BLE client can exploit improper length tracking in the protocomm_ble transport to cause the provisioning handler to read beyond allocated buffer boundaries. This results in potential information disclosure and denial of service for affected IoT devices.
Espressif IoT Development Framework versions 5.1.6-5.5.2 contain a use-after-free vulnerability in the BLE provisioning layer that allows remote attackers to trigger memory corruption when provisioning is stopped with keep_ble_on enabled. A connected BLE client can exploit freed GATT metadata through read/write callbacks to cause denial of service or potential code execution. Patches are available for all affected versions.
An out-of-bounds write in the BlueDroid AVRCP implementation of Espressif's ESP-IDF (avrc_vendor_msg) allows an attacker within Bluetooth Classic radio range to corrupt memory on affected ESP32-class devices, potentially causing crashes, undefined behavior, or controlled memory modification. The flaw affects ESP-IDF 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6 and earlier, but only firmware that actually uses the BlueDroid Bluetooth Classic host stack with the AVRCP profile active and that constructs or passes through vendor-dependent AVRCP commands with a large vendor_len; the CVE carries a CVSS 4.0 base score of 6.1 (AV:A/AC:L/AT:P/PR:N/UI:N) from the GitHub advisory, and an independent mapping to CVSS 3.1 (AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H) rates it moderate rather than critical because exploitation is proximity-bound and profile-dependent. No public exploit code has been identified at time of analysis, and vendor fixes are available through upstream commits referenced in GitHub advisory GHSA-43gh-7r4f-qp57. Note that the vulnerability's impact is worst on builds where assertions are disabled, since the original length check was implemented as an assert; mitigation is an update, not a configuration change, for devices that require AVRCP.
Out-of-bounds write in the BlueDroid Bluetooth host stack shipped with Espressif ESP-IDF 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6 and earlier allows a nearby attacker-controlled Bluetooth Classic device to corrupt memory on a target during SDP service discovery. The flaw is unauthenticated and requires only Bluetooth radio proximity (assessed CVSS:3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H), because a peer advertising more than 32 service UUIDs overflows the fixed-size uuid_list[32][MAX_UUID_SIZE] buffer in bta_dm_sdp_result(). No public exploit has been identified at time of analysis; upstream fixes are already committed and documented in GitHub advisory GHSA-hmjj-rjvv-w8pq.
Out-of-bounds read in Espressif ESP-IDF's Bluetooth AVRCP implementation can disclose limited memory contents or crash an affected ESP32 device when a connected peer sends a malformed VENDOR DEPENDENT command. ESP-IDF 5.1.6, 5.2.6, 5.3.4, 5.4.3, and 5.5.1 and earlier are affected when AVRCP is enabled; the independent assessment limits exposure to Bluetooth-adjacent attackers with an established AVRCP connection rather than internet-reachable systems. No public exploit was identified at time of analysis, EPSS is 0.08% (23rd percentile), and vendor fixes are available.
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. Rated medium severity (CVSS 5.2), this vulnerability is no authentication required, low attack complexity. This Buffer Copy without Size Check vulnerability could allow attackers to overflow a buffer to corrupt adjacent memory.
A security vulnerability in the ESP-NOW protocol implementation within the ESP Wi-Fi component of (CVSS 9.8). Critical severity with potential for significant impact on affected systems. Vendor patch is available.
Espressif Esp idf v5.3.0 is vulnerable to Insecure Permissions resulting in Authentication bypass. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue in Espressif Esp idf v5.3.0 allows attackers to cause a Denial of Service (DoS) via a crafted data channel packet. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Buffer Overflow vulnerability in esp-idf v.5.1 allows a remote attacker to obtain sensitive information via the externalId component. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Buffer Overflow vulnerability in esp-idf v.5.1 allows a remote attacker to execute arbitrary code via a crafted script to the Bluetooth stack component. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
ESP-IDF is the development framework for Espressif SoCs supported on Windows, Linux and macOS. Rated medium severity (CVSS 5.7), this vulnerability is no authentication required.
ESP-IDF is the official development framework for Espressif SoCs. Rated high severity (CVSS 8.8), this vulnerability is no authentication required, low attack complexity. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.
The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly restrict the Feature Page upon reception of an LMP Feature Response Extended packet, allowing attackers in. Rated high severity (CVSS 8.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly handle the reception of multiple LMP IO Capability Request packets during the pairing process, allowing. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly handle the reception of continuous unsolicited LMP responses, allowing attackers in radio range to trigger. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
The Bluetooth Low Energy (BLE) controller implementation in Espressif ESP-IDF 4.0 through 4.2 (for ESP32 devices) returns the wrong number of completed BLE packets and triggers a reachable assertion. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
The Bluetooth Low Energy (BLE) controller implementation in Espressif ESP-IDF 4.2 and earlier (for ESP32 devices) does not properly restrict the channel map field of the connection request packet on. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
An encryption-bypass issue was discovered on Espressif ESP-IDF devices through 4.2, ESP8266_NONOS_SDK devices through 3.0.3, and ESP8266_RTOS_SDK devices through 3.3. Rated medium severity (CVSS 6.8), this vulnerability is no authentication required. Public exploit code available and no vendor patch available.
An issue was discovered in Espressif ESP-IDF 2.x, 3.0.x through 3.0.9, 3.1.x through 3.1.6, 3.2.x through 3.2.3, and 3.3.x through 3.3.1. Rated medium severity (CVSS 6.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
The EAP peer implementation in Espressif ESP-IDF 2.0.0 through 4.0.0 and ESP8266_NONOS_SDK 2.2.0 through 3.1.0 processes EAP Success messages before any EAP method completion or failure, which allows. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The EAP peer implementation in Espressif ESP-IDF 2.0.0 through 4.0.0 and ESP8266_NONOS_SDK 2.2.0 through 3.1.0 allows the installation of a zero Pairwise Master Key (PMK) after the completion of any. Rated high severity (CVSS 8.1), this vulnerability is no authentication required, low attack complexity. Public exploit code available.