CAPEC-666
BlueSmacking
An adversary uses Bluetooth flooding to transfer large packets to Bluetooth enabled devices over the L2CAP protocol with the goal of creating a DoS. This attack must be carried out within close proximity to a Bluetooth enabled device.
On this page
Ask an AI about this attack pattern
Show the prompt
Explain the attack pattern CAPEC-666: BlueSmacking: how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/666.html and https://cve.bz/cve/capec/666?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.
How the attack unfolds
Explore
The attacker looks for a way in.
[Scan for Bluetooth Enabled Devices] Using BlueZ along with an antenna, an adversary searches for devices with Bluetooth on.
1 technique
- Note the MAC address of the device you want to attack.
Experiment
They probe what they found.
[Change L2CAP Packet Length] The adversary must change the L2CAP packet length to create packets that will overwhelm a Bluetooth enabled device.
1 technique
- An adversary downloads and installs BlueZ, the standard Bluetooth utility package for Linux.
Exploit
They carry out the attack.
[Flood] An adversary sends the packets to the target device, and floods it until performance is degraded.
Prerequisites
The system/application has Bluetooth enabled.
Skills required
- Low skill
An adversary only needs a Linux machine along with a Bluetooth adapter, which is extremely common.
Signs of an attack
Performance is degraded or halted by incoming L2CAP packets.
Consequences
| Impact | Affects | Note |
|---|---|---|
| Unreliable Execution, Resource Consumption | Availability |
Mitigations
Disable Bluetooth when not being used.
When using Bluetooth, set it to hidden or non-discoverable mode.
Weaknesses it exploits
- CWE-404 Improper Resource Shutdown or Release
Recent CVEs with these weaknesses
- 2.1CVE-2026-123964
A vulnerability was detected in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. This affects the function launch_goal of the file im_client/communication/communication_layer.py of the component Collaboration Laye…
- 5.3CVE-2026-123748
A security flaw has been discovered in chenyme grok2api up to 3.1.6. Affected by this vulnerability is the function proxyVoiceWebSocket of the file backend/internal/transport/http/inference/voice_ws_handler.go of the component WebSocket Pr…
- 2.1CVE-2026-122020
A security flaw has been discovered in NST Labs Tech Nstbrowser up to 1.2.1. The affected element is the function stopAllBrowsers of the file /api/agent/browser/stopAll of the component Local Agent Management Service. Performing a manipula…
- 2.1CVE-2026-121261
A vulnerability has been found in phpMyAdmin ShapeFile up to 4.0.1. Impacted is the function ShapeRecord::loadFromFile of the component SHP File Handler. Such manipulation leads to infinite loop. The attack can be executed remotely. The ex…
- 2.1CVE-2026-120237
A flaw has been found in ag-ui-protocol ag-ui up to 0.0.58. Affected by this issue is the function isInterruptExpired of the file sdks/typescript/packages/client/src/interrupts/index.ts of the component Interrupt expiry. This manipulation …
- 2.1CVE-2026-120235
A security vulnerability has been detected in ag-ui-protocol ag-ui up to 0.0.58. Affected is the function parseSSEStream of the file sdks/typescript/packages/client/src/transform/sse.ts of the component SSE Parser. The manipulation leads t…
- 2.1CVE-2026-120234
A weakness has been identified in ag-ui-protocol ag-ui up to 0.0.58. This impacts the function e.text of the component HTTP Transport. Executing a manipulation can lead to resource consumption. The attack can be launched remotely. The expl…
- 2.0CVE-2026-118276
A vulnerability was determined in a2ui-project a2ui up to 0.10.6. This vulnerability affects the function formatString of the file renderers/web_core/src/v0_9/basic_catalog/expressions/expression_parser.ts of the component Parser. This man…
The newest records naming one of them. Each weakness's page lists them all.
Related attack patterns
- Part of
- CAPEC-125 Flooding
MITRE's words, unchanged: CAPEC-666 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.