CVE-2021-1683

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-1683
Microsoft is aware of the "Impersonation in the Passkey Entry Protocol" vulnerability. For more information regarding the vulnerability, please see this?statement?from the Bluetooth SIG. To address the vulnerability, Microsoft has released a software update that will fail attempts to pair if the remote device exchanges a public key with the same X coordinate as the locally exchanged public key

5.0 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.3 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

2.1 /10

CVSS v2.0 : LOW

V2 Legend

Vector : AV:L/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References
Link Resource
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1683
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10:1803:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2016:1909:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10:2004:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2016:2004:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10:20h2:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2016:20h2:*:*:*:*:*:*:*
History

08 Oct 2024, 17:15

Type Values Removed Values Added
Summary Windows Bluetooth Security Feature Bypass Vulnerability Microsoft is aware of the "Impersonation in the Passkey Entry Protocol" vulnerability. For more information regarding the vulnerability, please see this?statement?from the Bluetooth SIG. To address the vulnerability, Microsoft has released a software update that will fail attempts to pair if the remote device exchanges a public key with the same X coordinate as the locally exchanged public key
References
  • {'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1683', 'name': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1683', 'tags': ['Patch', 'Vendor Advisory'], 'refsource': 'MISC'}
  • () https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1683 -

29 Dec 2023, 23:15

Type Values Removed Values Added
CVSS v2 : 2.1
v3 : 5.5 		v2 : 2.1
v3 : 5.0
Summary Windows Bluetooth Security Feature Bypass Vulnerability This CVE ID is unique from CVE-2021-1638, CVE-2021-1684. Windows Bluetooth Security Feature Bypass Vulnerability
Information

Published : 2021-01-12 20:15

Updated : 2024-10-08 17:15

NVD link : CVE-2021-1683

Mitre link : CVE-2021-1683

JSON object : View

Products Affected

microsoft

  • windows_8.1
  • windows_10
  • windows_rt_8.1
  • windows_server_2016
  • windows_server_2012
  • windows_server_2019
CWE
NVD-CWE-noinfo