Alpine iLX-F511 Bluetooth stack 0-day can leak data
Original title: ZDI-26-826: (0Day) (Pwn2Own) Alpine iLX-F511 libanwbtstack.so prh_rfcomm_cc_process_test Out-Of-Bounds Read Information Disclosure Vulnerability
An attacker must first pair a malicious Bluetooth device; ZDI scores the out-of-bounds read CVSS 3.5.
ZDI-26-826 is a Pwn2Own zero-day out-of-bounds read in libanwbtstack.so function prh_rfcomm_cc_process_test on Alpine iLX-F511. Network-adjacent attackers who can pair a malicious Bluetooth device can disclose sensitive information. ZDI assigned CVSS 3.5. No CVE or fix is stated.
Unconfirmed: Patch status and whether the issue is exploited are not stated.
- The bug is in libanwbtstack.so, function prh_rfcomm_cc_process_test.
- Pairing a malicious Bluetooth device is required first.
- ZDI's CVSS rating is 3.5.
Impact: disclosure of sensitive information on the device
| Product | Affected |
|---|---|
| Alpine iLX-F511 | — |
- Vendors
- Alpine
- Products
- Alpine iLX-F511libanwbtstack.so
- Organizations
- Zero Day Initiative
From the original article
This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Alpine iLX-F511 devices. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 3.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.