What is CVE-2018-20378?

CVE-2018-20378 is a high-severity vulnerability in Opensynergy Blue Sdk, classified under Improper Input Validation. CVSS score: 7.5/10. Published 2019-03-29.

How severe is CVE-2018-20378?

High severity. CVSS v3 base score is 7.5 out of 10.

Improper input validation in Opensynergy Blue Sdk

CVE-2018-20378

The L2CAP signaling channel implementation and SDP server implementation in OpenSynergy Blue SDK 3.2 through 6.0 allow remote, unauthenticated attackers to execute arbitrary code or cause a denial of service via malicious L2CAP configuration requests, in conjunction with crafted SDP communication over maliciously configured L2CAP channels. The attacker must have connectivity over the Bluetooth physical layer, and must be able to send raw L2CAP frames. This is related to L2Cap_HandleConfigReq in core/stack/l2cap/l2cap_sm.c and SdpServHandleServiceSearchAttribReq in core/stack/sdp/sdpserv.c.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.023 (81.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Opensynergy Blue_sdk
N/a — versions n/a

Weakness classification (CWE)

CWE-20 — Improper Input Validation

References

cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC)
cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2018-20378?: CVE-2018-20378 is a high-severity vulnerability in Opensynergy Blue Sdk, classified under Improper Input Validation. CVSS score: 7.5/10. Published 2019-03-29.
How severe is CVE-2018-20378?: High severity. CVSS v3 base score is 7.5 out of 10.