CVE-2019-19196
Medium
Description
The Bluetooth Low Energy Secure Manager Protocol (SMP) implementation on Telink Semiconductor BLE SDK versions before November 2019 for TLSR8x5x through 3.4.0, TLSR823x through 1.3.0, and TLSR826x through 3.3 devices accepts a pairing request with a key size greater than 16 bytes, allowing an attacker in radio range to cause a buffer overflow and denial of service (crash) via crafted packets.
SeverityMedium
CVSS6.5
Exploit probability—
ProductTelink-semi Tlsr8258 Ble Sdk
PublishedFeb 12, 2020
First seenFeb 12, 2020
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| telink-semi tlsr8258_ble_sdk | v ≤ 3.4.0 | — |
| telink-semi tlsr8269_ble_sdk | v ≤ 3.3 | — |
| telink-semi tlsr8253_ble_sdk | v ≤ 3.4.0 | — |
| telink-semi tlsr8251_ble_sdk | v ≤ 3.4.0 | — |
| telink-semi tlsr8232_ble_sdk | v ≤ 1.3.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.