{"vulnerability": "CVE-2021-3414", "sightings": [{"uuid": "78e8c4da-7f5b-4ab4-b5b3-4b0813eb5833", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34141", "type": "seen", "source": "https://t.me/cibsecurity/34233", "content": "\u203c CVE-2021-34141 \u203c\n\nIncomplete string comparison in the numpy.core component in NumPy1.9.x, which allows attackers to fail the APIs via constructing specific string objects.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-12-17T22:37:47.000000Z"}, {"uuid": "0895f627-9096-4b46-9301-591dbe26c5c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34149", "type": "seen", "source": "https://t.me/cibsecurity/28315", "content": "\u203c CVE-2021-34149 \u203c\n\nThe Bluetooth Classic implementation on the Texas Instruments CC256XCQFN-EM does not properly handle the reception of continuous LMP_AU_Rand packets, allowing attackers in radio range to trigger a denial of service (deadlock) of the device by flooding it with LMP_AU_Rand packets after the paging procedure.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-09-07T12:17:11.000000Z"}, {"uuid": "a64f8beb-3ff2-4622-9687-5fb160a887e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34146", "type": "seen", "source": "https://t.me/cibsecurity/28314", "content": "\u203c CVE-2021-34146 \u203c\n\nThe Bluetooth Classic implementation in the Cypress CYW920735Q60EVB does not properly handle the reception of continuous unsolicited LMP responses, allowing attackers in radio range to trigger a denial of service and restart (crash) of the device by flooding it with LMP_AU_Rand packets after the paging procedure.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-09-07T12:17:10.000000Z"}, {"uuid": "c9162e35-29b7-400f-95cf-03e003c16818", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34148", "type": "seen", "source": "https://t.me/cibsecurity/28313", "content": "\u203c CVE-2021-34148 \u203c\n\nThe Bluetooth Classic implementation in the Cypress WICED BT stack through 2.9.0 for CYW20735B1 devices does not properly handle the reception of LMP_max_slot with a greater ACL Length after completion of the LMP setup procedure, allowing attackers in radio range to trigger a denial of service (firmware crash) via a crafted LMP packet.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-09-07T12:17:09.000000Z"}, {"uuid": "488ca207-cdb0-48fa-9218-a093834ed523", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34145", "type": "seen", "source": "https://t.me/cibsecurity/28320", "content": "\u203c CVE-2021-34145 \u203c\n\nThe Bluetooth Classic implementation in the Cypress WICED BT stack through 2.9.0 for CYW20735B1 devices does not properly handle the reception of LMP_max_slot with an invalid Baseband packet type (and LT_ADDRESS and LT_ADDR) after completion of the LMP setup procedure, allowing attackers in radio range to trigger a denial of service (firmware crash) via a crafted LMP packet.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-09-07T12:17:17.000000Z"}, {"uuid": "1ad508b5-d199-4a59-b2f7-a3ced990f6ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34144", "type": "seen", "source": "https://t.me/cibsecurity/28309", "content": "\u203c CVE-2021-34144 \u203c\n\nThe Bluetooth Classic implementation in the Zhuhai Jieli AC6366C BT SDK through 0.9.1 does not properly handle the reception of truncated LMP_SCO_Link_Request packets while no other BT connections are active, allowing attackers in radio range to prevent new BT connections (disabling the AB5301A inquiry and page scan procedures) via a crafted LMP packet. The user needs to manually perform a power cycle (restart) of the device to restore BT connectivity.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-09-07T12:17:04.000000Z"}, {"uuid": "77103149-22e5-460e-8dd7-6ffd0f391fcb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34147", "type": "seen", "source": "https://t.me/cibsecurity/28326", "content": "\u203c CVE-2021-34147 \u203c\n\nThe Bluetooth Classic implementation in the Cypress WICED BT stack through 2.9.0 for CYW20735B1 does not properly handle the reception of a malformed LMP timing accuracy response followed by multiple reconnections to the link slave, allowing attackers to exhaust device BT resources and eventually trigger a crash via multiple attempts of sending a crafted LMP timing accuracy response followed by a sudden reconnection with a random BDAddress.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-09-07T12:17:27.000000Z"}, {"uuid": "6077f90c-cced-445d-a459-ebe44bac5de7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34147", "type": "seen", "source": "https://t.me/hacking_Attack/22454", "content": "io can lead to DoS in laptops and smartphones. Researchers were able to achieve this using gear containing Intel AX200 SoCs and Qualcomm WCN3990 SoCs.\n\nOne of the DoS bugs (CVE-2021-34147) exists because of a failure in the SoC to free resources upon receiving an invalid LMP_timing_accuracy_response from a connected BT device (i.e., a \u201cslave,\u201d according to the paper:\n\n\u201cThe attacker can exhaust the SoC by (a) paging, (b) sending the malformed packet, and (c) disconnecting without sending LMP_detach,\u201d researchers wrote. \u201cThese steps are repeated with a different BT address (i.e., BDAddress) until the SoC is exhausted from accepting new connections. On exhaustion, the SoC fails to recover itself and disrupts current active connections, triggering firmware crashes sporadically.\u201d\n\nThe researchers were able to forcibly disconnect slave BT devices from Windows and Linux laptops, and cause BT headset disruptions on Pocophone F1 and Oppo Reno 5G smartphones.\n\nAnother DoS bug (CVE pending) affects only devices using the Intel AX200 SoC.\n\nIt\u2019s triggered when an oversized LMP_timing_accuracy_request (i.e., bigger than 17 bytes) is sent to an AX200 slave.\n\n\u201cThis temporarily corrupts AX200 firmware, which responds incorrectly during a subsequent BT connection and eventually disables the paging scan procedure,\u201d researchers explained. \u201cThus, scanning AX200 works, but no connection is established from an external BT device.\u201d\n\nAside from disconnecting master BT devices connected to a vulnerable laptop and leading to sporadic BT firmware crashes, this state of affairs can also be used for man-in-the-middle (MiTM) attacks. Bad actors can easily trick a user into connecting to the attacker\u2019s BT hardware instead of the legitimate device, researchers noted \u2013 with persistence.\n\n\u201cIndeed, the user needs to manually re-enable BT to restore functionality,\u201d they said, adding, \u201cDue to the number of smartphones and laptops vulnerable to such attacks, and the common use of BT connectivity during video-conference calls and music streaming, updating the affected devices is essential.\u201d See Also: Hacking Stories: Andrian Lamo \u2013 The \u2018homeless\u2019 HackerBT Audio Product FreezesA third attack scenario was discovered while probing various BT speakers (specifically the Mi Portable Bluetooth Speaker \u2013 MDZ-36-DB, BT Headphone and BT Audio Modules) and an unbranded BT audio receiver.\n\nThey all are variously subject to a series of bugs (CVE-2021-31609 andCVE-2021-31612, failures when sending oversized LMP packets; CVE-2021-31613, truncated packets; CVE-2021-31611, starting procedures out-of-order; and CVE-2021-28135, CVE-2021-28155 and CVE-2021-31717, feature response flooding).\n\nSuccessful exploits can \u201cfreeze\u201d devices, requiring the user to manually turn on unresponsive devices afterwards. For the Xiaomi MDZ-36-DBs and JBL TUNE 500BTs, this can be done while the user is actively playing music, researchers noted.\n\n\u201cAlthough issues were found in SoCs targeted to audio products, the BT implementation can be reused in a number of SoCs destined to different BT products,\u201d they added.\n\nThese are just a few of the possible exploit scenarios; a full vulnerability listing with descriptions can be found here.\n\nThe researchers have released\u00a0a BrakTooth\u00a0proof-of-concept (PoC) tool for vendors producing BT SoCs, modules and products \u2013 available for them to use to check their gear\u2019s vulnerability.\n\nBlueTooth vulnerabilities are particularly concerning given the vast footprint that they can impact, and unfortunately, they\u2019re not that uncommon. For more, please see Threatpost\u2019s recent previous BlueTooth bug coverage:\n\n* Bluetooth Bug Opens Devices to Man-in-the-Middle Attacks\n* Bluetooth Bug Allows Man-in-the-Middle Attacks on Phones\n* Bluetooth Spoofing Bug Affects Billions of IoT Devices\nSource: threatpost.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/wordpress_[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:25.403318Z"}, {"uuid": "a7970bd3-b525-424f-be00-59068fe69356", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34147", "type": "seen", "source": "https://t.me/hacking_Attack/22454", "content": "io can lead to DoS in laptops and smartphones. Researchers were able to achieve this using gear containing Intel AX200 SoCs and Qualcomm WCN3990 SoCs.\n\nOne of the DoS bugs (CVE-2021-34147) exists because of a failure in the SoC to free resources upon receiving an invalid LMP_timing_accuracy_response from a connected BT device (i.e., a \u201cslave,\u201d according to the paper:\n\n\u201cThe attacker can exhaust the SoC by (a) paging, (b) sending the malformed packet, and (c) disconnecting without sending LMP_detach,\u201d researchers wrote. \u201cThese steps are repeated with a different BT address (i.e., BDAddress) until the SoC is exhausted from accepting new connections. On exhaustion, the SoC fails to recover itself and disrupts current active connections, triggering firmware crashes sporadically.\u201d\n\nThe researchers were able to forcibly disconnect slave BT devices from Windows and Linux laptops, and cause BT headset disruptions on Pocophone F1 and Oppo Reno 5G smartphones.\n\nAnother DoS bug (CVE pending) affects only devices using the Intel AX200 SoC.\n\nIt\u2019s triggered when an oversized LMP_timing_accuracy_request (i.e., bigger than 17 bytes) is sent to an AX200 slave.\n\n\u201cThis temporarily corrupts AX200 firmware, which responds incorrectly during a subsequent BT connection and eventually disables the paging scan procedure,\u201d researchers explained. \u201cThus, scanning AX200 works, but no connection is established from an external BT device.\u201d\n\nAside from disconnecting master BT devices connected to a vulnerable laptop and leading to sporadic BT firmware crashes, this state of affairs can also be used for man-in-the-middle (MiTM) attacks. Bad actors can easily trick a user into connecting to the attacker\u2019s BT hardware instead of the legitimate device, researchers noted \u2013 with persistence.\n\n\u201cIndeed, the user needs to manually re-enable BT to restore functionality,\u201d they said, adding, \u201cDue to the number of smartphones and laptops vulnerable to such attacks, and the common use of BT connectivity during video-conference calls and music streaming, updating the affected devices is essential.\u201d See Also: Hacking Stories: Andrian Lamo \u2013 The \u2018homeless\u2019 HackerBT Audio Product FreezesA third attack scenario was discovered while probing various BT speakers (specifically the Mi Portable Bluetooth Speaker \u2013 MDZ-36-DB, BT Headphone and BT Audio Modules) and an unbranded BT audio receiver.\n\nThey all are variously subject to a series of bugs (CVE-2021-31609 andCVE-2021-31612, failures when sending oversized LMP packets; CVE-2021-31613, truncated packets; CVE-2021-31611, starting procedures out-of-order; and CVE-2021-28135, CVE-2021-28155 and CVE-2021-31717, feature response flooding).\n\nSuccessful exploits can \u201cfreeze\u201d devices, requiring the user to manually turn on unresponsive devices afterwards. For the Xiaomi MDZ-36-DBs and JBL TUNE 500BTs, this can be done while the user is actively playing music, researchers noted.\n\n\u201cAlthough issues were found in SoCs targeted to audio products, the BT implementation can be reused in a number of SoCs destined to different BT products,\u201d they added.\n\nThese are just a few of the possible exploit scenarios; a full vulnerability listing with descriptions can be found here.\n\nThe researchers have released\u00a0a BrakTooth\u00a0proof-of-concept (PoC) tool for vendors producing BT SoCs, modules and products \u2013 available for them to use to check their gear\u2019s vulnerability.\n\nBlueTooth vulnerabilities are particularly concerning given the vast footprint that they can impact, and unfortunately, they\u2019re not that uncommon. For more, please see Threatpost\u2019s recent previous BlueTooth bug coverage:\n\n* Bluetooth Bug Opens Devices to Man-in-the-Middle Attacks\n* Bluetooth Bug Allows Man-in-the-Middle Attacks on Phones\n* Bluetooth Spoofing Bug Affects Billions of IoT Devices\nSource: threatpost.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/wordpress_[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:57.257212Z"}, {"uuid": "126d2ca1-287e-47e5-a615-e5673345ec0d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34147", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/22454", "content": "io can lead to DoS in laptops and smartphones. Researchers were able to achieve this using gear containing Intel AX200 SoCs and Qualcomm WCN3990 SoCs.\n\nOne of the DoS bugs (CVE-2021-34147) exists because of a failure in the SoC to free resources upon receiving an invalid LMP_timing_accuracy_response from a connected BT device (i.e., a \u201cslave,\u201d according to the paper:\n\n\u201cThe attacker can exhaust the SoC by (a) paging, (b) sending the malformed packet, and (c) disconnecting without sending LMP_detach,\u201d researchers wrote. \u201cThese steps are repeated with a different BT address (i.e., BDAddress) until the SoC is exhausted from accepting new connections. On exhaustion, the SoC fails to recover itself and disrupts current active connections, triggering firmware crashes sporadically.\u201d\n\nThe researchers were able to forcibly disconnect slave BT devices from Windows and Linux laptops, and cause BT headset disruptions on Pocophone F1 and Oppo Reno 5G smartphones.\n\nAnother DoS bug (CVE pending) affects only devices using the Intel AX200 SoC.\n\nIt\u2019s triggered when an oversized LMP_timing_accuracy_request (i.e., bigger than 17 bytes) is sent to an AX200 slave.\n\n\u201cThis temporarily corrupts AX200 firmware, which responds incorrectly during a subsequent BT connection and eventually disables the paging scan procedure,\u201d researchers explained. \u201cThus, scanning AX200 works, but no connection is established from an external BT device.\u201d\n\nAside from disconnecting master BT devices connected to a vulnerable laptop and leading to sporadic BT firmware crashes, this state of affairs can also be used for man-in-the-middle (MiTM) attacks. Bad actors can easily trick a user into connecting to the attacker\u2019s BT hardware instead of the legitimate device, researchers noted \u2013 with persistence.\n\n\u201cIndeed, the user needs to manually re-enable BT to restore functionality,\u201d they said, adding, \u201cDue to the number of smartphones and laptops vulnerable to such attacks, and the common use of BT connectivity during video-conference calls and music streaming, updating the affected devices is essential.\u201d See Also: Hacking Stories: Andrian Lamo \u2013 The \u2018homeless\u2019 HackerBT Audio Product FreezesA third attack scenario was discovered while probing various BT speakers (specifically the Mi Portable Bluetooth Speaker \u2013 MDZ-36-DB, BT Headphone and BT Audio Modules) and an unbranded BT audio receiver.\n\nThey all are variously subject to a series of bugs (CVE-2021-31609 andCVE-2021-31612, failures when sending oversized LMP packets; CVE-2021-31613, truncated packets; CVE-2021-31611, starting procedures out-of-order; and CVE-2021-28135, CVE-2021-28155 and CVE-2021-31717, feature response flooding).\n\nSuccessful exploits can \u201cfreeze\u201d devices, requiring the user to manually turn on unresponsive devices afterwards. For the Xiaomi MDZ-36-DBs and JBL TUNE 500BTs, this can be done while the user is actively playing music, researchers noted.\n\n\u201cAlthough issues were found in SoCs targeted to audio products, the BT implementation can be reused in a number of SoCs destined to different BT products,\u201d they added.\n\nThese are just a few of the possible exploit scenarios; a full vulnerability listing with descriptions can be found here.\n\nThe researchers have released\u00a0a BrakTooth\u00a0proof-of-concept (PoC) tool for vendors producing BT SoCs, modules and products \u2013 available for them to use to check their gear\u2019s vulnerability.\n\nBlueTooth vulnerabilities are particularly concerning given the vast footprint that they can impact, and unfortunately, they\u2019re not that uncommon. For more, please see Threatpost\u2019s recent previous BlueTooth bug coverage:\n\n* Bluetooth Bug Opens Devices to Man-in-the-Middle Attacks\n* Bluetooth Bug Allows Man-in-the-Middle Attacks on Phones\n* Bluetooth Spoofing Bug Affects Billions of IoT Devices\nSource: threatpost.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/wordpress_[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T17:00:04.435994Z"}, {"uuid": "608755da-88ec-41fb-9a05-411dc7b1bce4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34147", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/22454", "content": "io can lead to DoS in laptops and smartphones. Researchers were able to achieve this using gear containing Intel AX200 SoCs and Qualcomm WCN3990 SoCs.\n\nOne of the DoS bugs (CVE-2021-34147) exists because of a failure in the SoC to free resources upon receiving an invalid LMP_timing_accuracy_response from a connected BT device (i.e., a \u201cslave,\u201d according to the paper:\n\n\u201cThe attacker can exhaust the SoC by (a) paging, (b) sending the malformed packet, and (c) disconnecting without sending LMP_detach,\u201d researchers wrote. \u201cThese steps are repeated with a different BT address (i.e., BDAddress) until the SoC is exhausted from accepting new connections. On exhaustion, the SoC fails to recover itself and disrupts current active connections, triggering firmware crashes sporadically.\u201d\n\nThe researchers were able to forcibly disconnect slave BT devices from Windows and Linux laptops, and cause BT headset disruptions on Pocophone F1 and Oppo Reno 5G smartphones.\n\nAnother DoS bug (CVE pending) affects only devices using the Intel AX200 SoC.\n\nIt\u2019s triggered when an oversized LMP_timing_accuracy_request (i.e., bigger than 17 bytes) is sent to an AX200 slave.\n\n\u201cThis temporarily corrupts AX200 firmware, which responds incorrectly during a subsequent BT connection and eventually disables the paging scan procedure,\u201d researchers explained. \u201cThus, scanning AX200 works, but no connection is established from an external BT device.\u201d\n\nAside from disconnecting master BT devices connected to a vulnerable laptop and leading to sporadic BT firmware crashes, this state of affairs can also be used for man-in-the-middle (MiTM) attacks. Bad actors can easily trick a user into connecting to the attacker\u2019s BT hardware instead of the legitimate device, researchers noted \u2013 with persistence.\n\n\u201cIndeed, the user needs to manually re-enable BT to restore functionality,\u201d they said, adding, \u201cDue to the number of smartphones and laptops vulnerable to such attacks, and the common use of BT connectivity during video-conference calls and music streaming, updating the affected devices is essential.\u201d See Also: Hacking Stories: Andrian Lamo \u2013 The \u2018homeless\u2019 HackerBT Audio Product FreezesA third attack scenario was discovered while probing various BT speakers (specifically the Mi Portable Bluetooth Speaker \u2013 MDZ-36-DB, BT Headphone and BT Audio Modules) and an unbranded BT audio receiver.\n\nThey all are variously subject to a series of bugs (CVE-2021-31609 andCVE-2021-31612, failures when sending oversized LMP packets; CVE-2021-31613, truncated packets; CVE-2021-31611, starting procedures out-of-order; and CVE-2021-28135, CVE-2021-28155 and CVE-2021-31717, feature response flooding).\n\nSuccessful exploits can \u201cfreeze\u201d devices, requiring the user to manually turn on unresponsive devices afterwards. For the Xiaomi MDZ-36-DBs and JBL TUNE 500BTs, this can be done while the user is actively playing music, researchers noted.\n\n\u201cAlthough issues were found in SoCs targeted to audio products, the BT implementation can be reused in a number of SoCs destined to different BT products,\u201d they added.\n\nThese are just a few of the possible exploit scenarios; a full vulnerability listing with descriptions can be found here.\n\nThe researchers have released\u00a0a BrakTooth\u00a0proof-of-concept (PoC) tool for vendors producing BT SoCs, modules and products \u2013 available for them to use to check their gear\u2019s vulnerability.\n\nBlueTooth vulnerabilities are particularly concerning given the vast footprint that they can impact, and unfortunately, they\u2019re not that uncommon. For more, please see Threatpost\u2019s recent previous BlueTooth bug coverage:\n\n* Bluetooth Bug Opens Devices to Man-in-the-Middle Attacks\n* Bluetooth Bug Allows Man-in-the-Middle Attacks on Phones\n* Bluetooth Spoofing Bug Affects Billions of IoT Devices\nSource: threatpost.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/wordpress_[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-08T00:00:39.062434Z"}]}