HOMEVULNERABILITIESCVE-2023-24023
MEDIUM

CVE-2023-24023

NVD-CWE-noinfoPublished: November 28, 2023· Updated: Jun 17, 2026

6.8
CVSS v3.1

Official Description

Bluetooth BR/EDR devices with Secure Simple Pairing and Secure Connections pairing in Bluetooth Core Specification 4.2 through 5.4 allow certain man-in-the-middle attacks that force a short key length, and might lead to discovery of the encryption key and live injection, aka BLUFFS.

NVD Source

Technical Analysis

CVE-2023-24023 requires adjacent network access, limiting remote exploitation but still posing risk in shared or local network environments.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), with a CVSS base score of 6.8.

CVSS v3.1 Vector Breakdown

Exploitability
Attack VectorAdjacent
Attack ComplexityHigh
Privileges Req.None
User InteractionNone
ScopeUnchanged
Impact
ConfidentialityHigh
IntegrityHigh
AvailabilityNone
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected Vendors & Products

bluetooth1 product(s)
bluetooth core specification
Microsoft9 product(s)
windows 10 1809windows 10 21h2windows 10 22h2windows 11 21h2windows 11 22h2windows 11 23h2windows server 2019windows server 2022windows server 2022 23h2
Source: NVD CPE · 10 total CPE entries

Exploit & PoC Resources

NO KNOWN EXPLOITNo public exploit confirmed at this time
Exploit-DB
Offensive Security exploit database
GitHub PoC Search
Community PoC repositories
Rapid7 / Metasploit
Metasploit module search
PacketStorm
Security advisories & exploits
NVD Detail
Official NIST entry
MITRE CVE
CVE Program entry
External links open in a new tab. Always verify in a controlled environment before use.

Official Patches & Advisories

ADVISORYhttps://dl.acm.org/doi/10.1145/3576915.3623066
ADVISORYhttps://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/bluffs-vulnerability/
ADVISORYhttps://dl.acm.org/doi/10.1145/3576915.3623066
ADVISORYhttps://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/bluffs-vulnerability/

All References (4)

→
https://dl.acm.org/doi/10.1145/3576915.3623066Technical Description · Third Party Advisory
→
https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/bluffs-vulnerability/Vendor Advisory
→
https://dl.acm.org/doi/10.1145/3576915.3623066Technical Description · Third Party Advisory
→
https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/bluffs-vulnerability/Vendor Advisory

Quick Facts

CVE IDCVE-2023-24023
CVSS Score6.8 / 10
SeverityMEDIUM
WeaknessNVD-CWE-noinfo
CISA KEVNo
Affected2 vendor(s)
PublishedNov 28, 2023

Related CVEs (NVD-CWE-noinfo)

CVE-2021-2317
10.0
CVE-2021-2256
10.0
CVE-2021-2244
10.0
CVE-2021-2177
10.0
CVE-2021-2248
10.0
CVE-2016-20010
10.0

Recommended Actions

  • →Apply vendor patches immediately
  • →Monitor CVE-2023-24023 in threat intel feeds
  • →Review IDS/IPS signatures for exploitation attempts
Data sourced from NVD (NIST), CISA KEV, and EPSS (FIRST). Analysis generated by CTIWATCH.COM. CVE data is provided under the NVD usage policy.
← All Vulnerabilities·Search for CVE-2023-24023·NVD