CVSS 3.1
8.1 highCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NCVE-2019-9506
The Bluetooth BR/EDR specification up to and including version 5.1 permits sufficiently low encryption key length and does not prevent an attacker from influencing the key length negotiation. This allows practical brute-force attacks (aka "KNOB") that can decrypt traffic and inject arbitrary ciphertext without the victim noticing.
Severity
- EPSS
- 2.7% chance of exploitation in the next 30 days; higher than 85% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-327, CWE-310
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apple:iphone_os
- apple:mac_os_x
- apple:tvos
- apple:watchos
- canonical:ubuntu_linux
- debian:debian_linux
- google:android
- huawei:alp-al00b_firmware
- huawei:ares-al00b_firmware
- huawei:ares-al10d_firmware
- huawei:ares-tl00c_firmware
- huawei:asoka-al00ax_firmware
- huawei:atomu-l33_firmware
- huawei:atomu-l41_firmware
- huawei:atomu-l42_firmware
- huawei:barca-al00_firmware
- huawei:berkeley-al20_firmware
- huawei:berkeley-l09_firmware
- huawei:berkeley-tl10_firmware
- huawei:bla-al00b_firmware
- huawei:bla-l29c_firmware
- huawei:bla-tl00b_firmware
- huawei:cairogo-l22_firmware
- huawei:charlotte-l29c_firmware
- huawei:columbia-al10b_firmware
- huawei:columbia-al10i_firmware
- huawei:columbia-l29d_firmware
- huawei:columbia-tl00d_firmware
- huawei:cornell-al00a_firmware
- huawei:cornell-al00i_firmware
- huawei:cornell-al00ind_firmware
- huawei:cornell-al10ind_firmware
- huawei:cornell-l29a_firmware
- huawei:cornell-tl10b_firmware
- huawei:dubai-al00a_firmware
- huawei:dura-al00a_firmware
- huawei:dura-tl00a_firmware
- huawei:emily-l29c_firmware
- huawei:ever-l29b_firmware
- huawei:figo-l23_firmware
- huawei:figo-l31_firmware
- huawei:figo-tl10b_firmware
- huawei:florida-al20b_firmware
- huawei:florida-l21_firmware
- huawei:florida-l22_firmware
- huawei:florida-l23_firmware
- huawei:florida-tl10b_firmware
- huawei:harry-al00c_firmware
- huawei:harry-al10b_firmware
- huawei:harry-tl00c_firmware