Critical severity · published Feb 19, 2024
CVE-2024-1638
Bluetooth characteristic LESC security requirement not enforced without additional flags
9.1
CVSS
0.4%
EPSS
No
On KEV
Description
The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characteristic: Attribute read/write permission with LE Secure Connection encryption. If set, requires that LE Secure Connections is used for read/write access, however this is only true when it is combined with other permissions, namely BT_GATT_PERM_READ_ENCRYPT/BT_GATT_PERM_READ_AUTHEN (for read) or BT_GATT_PERM_WRITE_ENCRYPT/BT_GATT_PERM_WRITE_AUTHEN (for write), if these additional permissions are not set (even in secure connections only mode) then the stack does not perform any permission checks on these characteristics and they can be freely written/read.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ZE
Zephyr · zephyrproject-rtos
through 3.5 · source: vendor, NVD, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-1638
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-1638
Exploit
https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-p6f3-f63q-5mc2
More from Zephyr
9.8
CVE-2026-5067
Out-of-bounds read/write in HTTP WebSocket upgrade via non-null-terminated Sec-WebSocket-Key
9.8
CVE-2026-1678
dns: memory‑safety issue in the DNS name parser
9.8
CVE-2023-6881
fs: fuse: buffer overflow vulnerability in the Zephyr FS
9.8
CVE-2023-5779
can: out of bounds in remove_rx_filter function
9.8
CVE-2023-6249
ipm: signed to unsigned conversion problem in esp32_ipm_send
