CVE-2021-3658

bluez: adapter incorrectly restores Discoverable state after powered down

Loading…

Severity

Low

Red Hat Product Security

4.6

CVSS 3.1

Review impact separately from score.

Published · July 27, 2021

Updated · April 16, 2026

Description

bluetoothd from bluez incorrectly saves adapters' Discoverable status when a device is powered down, and restores it when powered up. If a device is powered down while discoverable, it will be discoverable when powered on again. This could lead to inadvertent exposure of the bluetooth stack to physically nearby attackers.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

If bluetooth is disabled or never powered on, this vulnerability is not exposed.

CVSS / CWE

CVSS 3.1 · 4.6
CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

CWE-863 · Incorrect Authorization