CVE-2022-24695 in Bluetooth
Summary
by MITRE • 06/02/2023
Bluetooth Classic in Bluetooth Core Specification through 5.3 does not properly conceal device information for Bluetooth transceivers in Non-Discoverable mode. By conducting an efficient over-the-air attack, an attacker can fully extract the permanent, unique Bluetooth MAC identifier, along with device capabilities and identifiers, some of which may contain identifying information about the device owner. This additionally allows the attacker to establish a connection to the target device.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 05/03/2026
The vulnerability described in CVE-2022-24695 represents a critical weakness in the Bluetooth Classic implementation within the Bluetooth Core Specification versions up to 5.3. This flaw fundamentally undermines the security assumptions surrounding device discoverability modes, particularly the Non-Discoverable state that users and developers expect to provide privacy protection. The issue manifests in the improper handling of device information exposure even when devices are configured to operate in non-discoverable modes, creating a significant gap between intended security posture and actual implementation. This vulnerability directly impacts the core privacy mechanisms that Bluetooth devices rely on to protect user identity and device-specific information from unauthorized access.
The technical flaw stems from the failure of Bluetooth Classic implementations to properly mask or conceal critical device identifiers when operating in Non-Discoverable mode. Specifically, attackers can exploit weaknesses in the over-the-air communication protocols to extract permanent Bluetooth MAC addresses, device capabilities, and other identifying information that should remain hidden. This extraction process operates through well-established Bluetooth protocol analysis techniques that leverage the inherent characteristics of the wireless communication stack. The vulnerability essentially allows attackers to bypass the fundamental security controls that should prevent device enumeration and identification, effectively turning devices that should be invisible into easily targetable entities. The flaw operates at the protocol level rather than the application level, making it particularly dangerous as it affects the core Bluetooth stack implementation across multiple vendors and device types.
The operational impact of this vulnerability extends far beyond simple information disclosure, as it enables full connection establishment capabilities against target devices. Attackers who successfully extract the necessary device identifiers can not only identify specific devices but also establish legitimate Bluetooth connections, potentially leading to further exploitation opportunities. This capability creates a pathway for various attack vectors including man-in-the-middle attacks, device impersonation, and unauthorized data access. The vulnerability affects all Bluetooth devices that implement the Classic Bluetooth specification in versions up to 5.3, making it particularly widespread across the IoT and mobile device ecosystem. The ability to extract identifying information without requiring physical proximity or specialized equipment significantly increases the attack surface and makes this vulnerability particularly attractive to threat actors.
From a cybersecurity perspective, this vulnerability maps directly to CWE-200 (Information Exposure) and CWE-310 (Cryptographic Issues) categories, as it exposes sensitive device identifiers that should remain confidential. The attack pattern aligns with ATT&CK techniques such as T1592 (Resource Hijacking) and T1046 (Network Service Scanning) where adversaries can enumerate and target specific devices. The vulnerability also relates to T1566 (Phishing) in contexts where device identification can be used to craft more convincing social engineering attacks. Organizations should implement immediate mitigations including firmware updates from device manufacturers, network segmentation to isolate Bluetooth traffic, and monitoring for unauthorized Bluetooth connections. Additionally, security teams should consider disabling Bluetooth when not in use, implementing MAC address randomization where available, and conducting regular Bluetooth network surveys to identify vulnerable devices. The vulnerability highlights the importance of proper security testing of wireless protocols and the need for comprehensive privacy controls even in seemingly secure operational modes.