CVE-2021-40526

Name of the Vulnerable Software and Affected Versions Peleton TTR01 up to and including PTV55G

Description The issue is related to an incorrect calculation of buffer size, allowing a remote attacker to trigger a Denial of Service attack through the GymKit daemon process. This is achieved by exploiting a heap overflow in the network server handling the Apple GymKit communication, which can prevent an Apple MFI device from authenticating with the Peleton Bike.

Recommendations For Peleton TTR01 up to and including PTV55G, as a temporary workaround, consider disabling the GymKit daemon process until a patch is available. Restrict access to the network server handling the Apple GymKit communication to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.