Summary
Critical vulnerabilities have been discovered in the utilized Bluetooth component.
For more information see: https://kb.cert.org/vuls/id/799380
Details
Impact
Pepperl+Fuchs analyzed and identified affected devices.
An unauthorized attacker could gain access to the audio communication and listen to the conversation via Bluetooth.
This attack can only be carried out at close range and is limited by the radio range of Bluetooth.
The impact of the vulnerabilities on the affected device may result in
information disclosure
Remediation
The device will play a confirmation sound when a Bluetooth connection is successfully established and a status LED labeled BT indicates that a Bluetooth connection is active.
This can be used to detect an unauthenticated connection.
Vulnerabilities 6
-
Unscored —
Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B through 5.2 may permit an unauthenticated…
-
Unscored —
Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device, able to conduct a successful …
-
Unscored —
Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device (without possession of the Aut…
-
Unscored —
Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 through 5.2 may permit a nearby man-in-the-m…
-
Unscored —
Bluetooth Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device (participating in th…
-
Unscored —
Bluetooth Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device, reflecting the auth…
Revision history
-
#2
Fix: quotation mark
-
#1
initial revision
References
-
VDE-2022-021: Pepperl+Fuchs: RSM-EX devices - Multiple Bluetooth vulnerabilities - HTML
https://certvde.com/de/advisories/VDE-2022-021/
-
CERT@VDE Security Advisories for Pepperl+Fuchs SE
https://certvde.com/en/advisories/vendor/pepperl-fuchs/