CVE-2021-1638

HIGH

Windows 10 and Windows Server 2016/2019 - Impersonation in Passkey Entry Protocol

Title source: llm

Description

Microsoft is aware of the "Impersonation in the Passkey Entry Protocol" vulnerability. For more information regarding the vulnerability, please see this statement from the Bluetooth SIG. To address the vulnerability, Microsoft has released a software update that will fail attempts to pair if the remote device exchanges a public key with the same X coordinate as the locally exchanged public key

References (2)

Core 2

Core References

Vendor Advisory vendor-advisory

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1638

Vendor Advisory

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1638

Scores

CVSS v3 7.7

EPSS 0.0121

EPSS Percentile 65.2%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Details

Status published

Products (9)

microsoft/windows_10 20h2

microsoft/windows_10 1803

microsoft/windows_10 1809

microsoft/windows_10 1909

microsoft/windows_10 2004

microsoft/windows_server_2016 20h2

microsoft/windows_server_2016 1909

microsoft/windows_server_2016 2004

microsoft/windows_server_2019

Published Jan 12, 2021

Tracked Since Feb 18, 2026