francozappa

3 exploits Active since Aug 2019
CVE-2019-9506 NOMISEC HIGH WORKING POC
Android - Bluetooth BR/EDR Encryption Key Length Downgrade via KNOB Attack
The Bluetooth BR/EDR specification up to and including version 5.1 permits sufficiently low encryption key length and does not prevent an attacker from influencing the key length negotiation. This allows practical brute-force attacks (aka "KNOB") that can decrypt traffic and inject arbitrary ciphertext without the victim noticing.
187 stars
CVSS 8.1
CVE-2022-20361 NOMISEC CRITICAL WORKING POC
Android - Remote Privilege Escalation via Bluetooth Cross-Transport Key Derivation Weakness
In btif_dm_auth_cmpl_evt of btif_dm.cc, there is a possible vulnerability in Cross-Transport Key Derivation due to Weakness in Bluetooth Standard. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-231161832
19 stars
CVSS 9.8
CVE-2020-15802 NOMISEC MEDIUM WORKING POC
Bluetooth Core Specification < 5.1 - Unauthenticated Man-in-the-Middle via Cross Transport Key Derivation
Devices supporting Bluetooth before 5.1 may allow man-in-the-middle attacks, aka BLURtooth. Cross Transport Key Derivation in Bluetooth Core Specification v4.2 and v5.0 may permit an unauthenticated user to establish a bonding with one transport, either LE or BR/EDR, and replace a bonding already established on the opposing transport, BR/EDR or LE, potentially overwriting an authenticated key with an unauthenticated key, or a key with greater entropy with one with less.
19 stars
CVSS 5.9