Microsoft is aware of the "Impersonation in the Passkey Entry Protocol" vulnerability. For more information regarding the vulnerability, please see this statement from the Bluetooth SIG.
To address the vulnerability, Microsoft has released a software update that will fail attempts to pair if the remote device exchanges a public key with the same X coordinate as the locally exchanged public key

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

Access Vector Local

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.03628.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Microsoft Windows 10 Version 20H2 affected
Version Status Constraints
10.0.0 affected < publication
Microsoft Windows Server version 20H2 affected
Version Status Constraints
10.0.0 affected < publication
Microsoft Windows 10 Version 1803 affected
Version Status Constraints
10.0.0 affected < publication
Microsoft Windows 10 Version 1809 affected
Version Status Constraints
10.0.0 affected < publication
Microsoft Windows Server 2019 affected
Version Status Constraints
10.0.0 affected < publication
Microsoft Windows Server 2019 (Server Core installation) affected
Version Status Constraints
10.0.0 affected < publication
Microsoft Windows 10 Version 1909 affected
Version Status Constraints
10.0.0 affected < publication
Microsoft Windows Server, version 1909 (Server Core installation) affected
Version Status Constraints
10.0.0 affected < publication
Microsoft Windows 10 Version 2004 affected
Version Status Constraints
10.0.0 affected < publication
Microsoft Windows Server version 2004 affected
Version Status Constraints
10.0.0 affected < publication
Microsoft Windows 10 Version 1507 affected
Version Status Constraints
10.0.0 affected < publication
Microsoft Windows 10 Version 1607 affected
Version Status Constraints
10.0.0 affected < publication
Microsoft Windows Server 2016 affected
Version Status Constraints
10.0.0 affected < publication
Microsoft Windows Server 2016 (Server Core installation) affected
Version Status Constraints
10.0.0 affected < publication
Microsoft Windows 8.1 affected
Version Status Constraints
6.3.0 affected < publication
Microsoft Windows Server 2012 R2 affected
Version Status Constraints
6.3.0 affected < publication
Microsoft Windows Server 2012 R2 (Server Core installation) affected
Version Status Constraints
6.3.0 affected < publication

Configuration 1 [-]

OR cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10:20h2:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10:1803:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10:2004:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2016:20h2:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2016:1909:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2016:2004:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*

No data.

No data.

Project Subscriptions

Vendors Products
Microsoft Subscribe
Windows 10 Subscribe
Windows 10 1507 Subscribe
Windows 10 1607 Subscribe
Windows 10 1803 Subscribe
Windows 10 1809 Subscribe
Windows 10 1909 Subscribe
Windows 10 20h2 Subscribe
Windows 8.1 Subscribe
Windows Rt 8.1 Subscribe
Windows Server 1909 Subscribe
Windows Server 2004 Subscribe
Windows Server 2012 Subscribe
Windows Server 2012 R2 Subscribe
Windows Server 2016 Subscribe
Windows Server 2019 Subscribe
Windows Server 20h2 Subscribe
Advisories
Source ID Title
EUVD EUVD EUVD-2021-7150 Microsoft is aware of the &quot;Impersonation in the Passkey Entry Protocol&quot; vulnerability. For more information regarding the vulnerability, please see this statement from the Bluetooth SIG. To address the vulnerability, Microsoft has released a software update that will fail attempts to pair if the remote device exchanges a public key with the same X coordinate as the locally exchanged public key
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1683 cve-icon cve-icon
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1683 cve-icon
History

Fri, 22 Nov 2024 12:00:00 +0000

Type Values Removed Values Added
References

Tue, 08 Oct 2024 17:45:00 +0000

Type Values Removed Values Added
References

Tue, 08 Oct 2024 16:30:00 +0000

Type Values Removed Values Added
Description Windows Bluetooth Security Feature Bypass Vulnerability Microsoft is aware of the &quot;Impersonation in the Passkey Entry Protocol&quot; vulnerability. For more information regarding the vulnerability, please see this statement from the Bluetooth SIG. To address the vulnerability, Microsoft has released a software update that will fail attempts to pair if the remote device exchanges a public key with the same X coordinate as the locally exchanged public key
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: microsoft

Published:

Updated: 2024-10-08T16:17:19.706Z

Reserved: 2020-12-02T00:00:00

Link: CVE-2021-1683

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2021-01-12T20:15:32.807

Modified: 2024-11-21T05:44:53.297

Link: CVE-2021-1683

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses