CVE-2021-28139

Published September 7th, 2021

View on NVD ↗

CVSS v3

8.8

HIGH

CVSS v2

8.3

HIGH

Affected

PROJECTS

Description

The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly restrict the Feature Page upon reception of an LMP Feature Response Extended packet, allowing attackers in radio range to trigger arbitrary code execution in ESP32 via a crafted Extended Features bitfield payload.

espressif/esp-idf

Espressif IoT Development Framework. Official development framework for Espressif SoCs.

GitHub

18.2K

espressif/esp32-bt-lib

ESP32 Bluetooth stack (below HCI layer) precompiled libraries

GitHub