CVE-2019-9506

HIGH

Android - Bluetooth BR/EDR Encryption Key Length Downgrade via KNOB Attack

Title source: manual

Exploitation Summary

EIP tracks 2 public exploits for CVE-2019-9506. PoCs published by francozappa, coffeeesd.

AI-analyzed exploit summary This repository contains a proof-of-concept for the KNOB attack (CVE-2019-9506), which exploits a vulnerability in Bluetooth BR/EDR and BLE key negotiation to downgrade encryption entropy. It includes tools for brute-forcing E0 encryption keys and a patched Linux kernel for testing BLE vulnerabilities.

Description

The Bluetooth BR/EDR specification up to and including version 5.1 permits sufficiently low encryption key length and does not prevent an attacker from influencing the key length negotiation. This allows practical brute-force attacks (aka "KNOB") that can decrypt traffic and inject arbitrary ciphertext without the victim noticing.

Exploits (2)

nomisec WORKING POC 187 stars

by francozappa · poc

https://github.com/francozappa/knob

View Code ZIP pw:eip

This repository contains a proof-of-concept for the KNOB attack (CVE-2019-9506), which exploits a vulnerability in Bluetooth BR/EDR and BLE key negotiation to downgrade encryption entropy. It includes tools for brute-forcing E0 encryption keys and a patched Linux kernel for testing BLE vulnerabilities.

Classification

Working Poc 90%

Attack Type

Other

Complexity

Complex

Reliability

Reliable

Target: Bluetooth BR/EDR and BLE implementations

No auth needed

Prerequisites: Proximity to target Bluetooth device · Custom Linux kernel patch for BLE testing

MITRE ATT&CK

T1587.001 - Malware

devstral-2 · analyzed Feb 16, 2026 Full analysis →

nomisec WRITEUP

by coffeeesd · poc

https://github.com/coffeeesd/knob

View Code ZIP pw:eip

This repository contains Python scripts for simulating and analyzing the power distribution and mechanical dynamics of a tram system. It includes calculations for resistance, voltage, current, and power, but does not contain any exploit code or offensive techniques.

Classification

Writeup 90%

Attack Type

Other

Complexity

Moderate

Reliability

Theoretical

Target: N/A

No auth needed

Prerequisites: Python environment with numpy and matplotlib

devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (30)

Core 30

Core References

Third Party Advisory, US Government Resource third-party-advisory x_refsource_cert-vn

https://www.kb.cert.org/vuls/id/918987/

Third Party Advisory x_refsource_misc

http://www.cs.ox.ac.uk/publications/publication12404-abstract.html

Third Party Advisory x_refsource_misc

https://www.usenix.org/conference/usenixsecurity19/presentation/antonioli

Third Party Advisory x_refsource_confirm

https://www.bluetooth.com/security/statement-key-negotiation-of-bluetooth/

Mailing List, Third Party Advisory mailing-list x_refsource_fulldisc

http://seclists.org/fulldisclosure/2019/Aug/14

Mailing List, Third Party Advisory mailing-list x_refsource_fulldisc

http://seclists.org/fulldisclosure/2019/Aug/11

Mailing List, Third Party Advisory mailing-list x_refsource_fulldisc

http://seclists.org/fulldisclosure/2019/Aug/13

Mailing List, Third Party Advisory mailing-list x_refsource_fulldisc

http://seclists.org/fulldisclosure/2019/Aug/15

Third Party Advisory x_refsource_confirm

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190828-01-knob-en

Third Party Advisory vendor-advisory x_refsource_ubuntu

https://usn.ubuntu.com/4115-1/

Third Party Advisory vendor-advisory x_refsource_ubuntu

https://usn.ubuntu.com/4118-1/

Mailing List, Third Party Advisory mailing-list x_refsource_mlist

https://lists.debian.org/debian-lts-announce/2019/09/msg00014.html

Mailing List, Third Party Advisory mailing-list x_refsource_mlist

https://lists.debian.org/debian-lts-announce/2019/09/msg00015.html

Mailing List, Third Party Advisory mailing-list x_refsource_mlist

https://lists.debian.org/debian-lts-announce/2019/09/msg00025.html

Third Party Advisory vendor-advisory x_refsource_ubuntu

https://usn.ubuntu.com/4147-1/