Daniele Antonioli

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 18 iPadOS versions prior to 18 **Description** A malicious Bluetooth input device may bypass pairing due to an issue that was addressed through improved state management. **Recommendations** For iOS versions prior to 18, update to iOS 18 to resolve the issue. For iPadOS versions prior to 18, update to iPadOS 18 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Bluetooth BR/EDR Core Specification versions prior to v5.2 **Description** The issue concerns a flaw in the authentication procedure of the Bluetooth BR/EDR protocol, allowing an unauthenticated, adjacent attacker to impersonate a Bluetooth BR/EDR master or slave and pair with a previously paired remote device without knowing the link key. This could potentially compromise the confidentiality and integrity of protected information. **Recommendations** For Bluetooth BR/EDR Core Specification versions prior to v5.2, consider implementing additional authentication measures or restricting access to sensitive data until a patch or update is available. As a temporary workaround, restrict the use of legacy pairing and secure-connections pairing authentication to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Broadcom firmware versions prior to summer 2014 **Description** The issue is related to the improper restriction of LMP commands in Broadcom firmware, which can lead to the execution of certain memory contents upon receiving an LMP command. This can be demonstrated by executing an HCI command. The estimated number of potentially affected devices worldwide is not specified. **Recommendations** For Broadcom firmware versions prior to summer 2014, consider disabling the execution of LMP commands as a temporary workaround until a patch is available. Restrict access to the vulnerable firmware to minimize the risk of exploitation. Avoid using the `LMP` command in the affected devices until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Bluetooth BR/EDR versions up to and including 5.1 **Description** The issue concerns the Bluetooth BR/EDR specification, which permits sufficiently low encryption key length and does not prevent an attacker from influencing the key length negotiation. This allows practical brute-force attacks that can decrypt traffic and inject arbitrary ciphertext without the victim noticing. The vulnerability can be exploited by an unauthenticated, adjacent attacker to initiate a man-in-the-middle attack, reducing the negotiated entropy length used for secure connections. The flaw affects a wide range of Bluetooth-enabled devices, including smartphones, laptops, IoT devices, and industrial devices. **Recommendations** For Bluetooth BR/EDR versions up to and including 5.1, consider disabling the key negotiation process until a patch is available. As a temporary workaround, restrict access to the encryption key negotiation process to minimize the risk of exploitation. Avoid using the Bluetooth BR/EDR protocol for sensitive connections until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.