Description
security.c in hcid for BlueZ 2.16, 2.17, and 2.18 allows remote attackers to execute arbitrary commands via shell metacharacters in the Bluetooth device name when invoking the PIN helper.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗Advisories 2
- DSA-782-1 bluez-utils - missing input sanitising Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-9-1 bluez-utils - bad device name escaping Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://cvs.sourceforge.net/viewcvs.py/bluez/utils/hcid/security.c?r1=1.31&r2=1.34
- 16476 third-party-advisory
- DSA-782 vendor-advisory
- https://bugs.gentoo.org/show_bug.cgi?id=101557
- GLSA-200508-09 vendor-advisory
- 16453 third-party-advisory
- 14572 vdb-entry
- [bluez-devel] 20050804 Possible security vulnerability in hcid when calling pin helper mailing-list