CVE-2023-24023 Weak cryptography in n/a

Medium 6.4 Published 28 Nov 2023 Updated 2 Aug 2024

Man-in-the-middle attackers can force short Bluetooth encryption keys, potentially exposing keys and allowing live injection.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2023-24023?

CVE-2023-24023 is a medium-severity vulnerability in Microsoft Windows 10 1809, published on 28 Nov 2023. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

Bluetooth BR/EDR devices with Secure Simple Pairing and Secure Connections pairing in Bluetooth Core Specification 4.2 through 5.4 allow certain man-in-the-middle attacks that force a short key length, and might lead to discovery of the encryption key and live injection, aka BLUFFS.

Which versions are affected by CVE-2023-24023?

It affects 10 products.

Products include Bluetooth Bluetooth Core Specification, Microsoft Windows 10 1809, Microsoft Windows 10 21h2, Microsoft Windows 10 22h2, Microsoft Windows 11 21h2, Microsoft Windows 11 22h2 and 4 more.

How do I fix CVE-2023-24023?

Apply the vendor's patch.

Is CVE-2023-24023 being exploited?

There is no known exploitation of CVE-2023-24023 in the wild and no public exploit code.

All Microsoft Windows 10 1809 vulnerabilities

Sources

Also known as A-255601934, ASB-A-255601934, BELL-CVE-2023-24023, DEBIAN-CVE-2023-24023, GHSA-4rvq-6825-fp99, ROOT-OS-DEBIAN-11-CVE-2023-24023 and 1 more.