VulnerabilityModified

CVE-2021-1638

Microsoft is aware of the "Impersonation in the Passkey Entry Protocol" vulnerability.

HIGH 7.7EPSS 1.21%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (1.21%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Microsoft is aware of the "Impersonation in the Passkey Entry Protocol" vulnerability. For more information regarding the vulnerability, please see this statement from the Bluetooth SIG. To address the vulnerability, Microsoft has released a software update that will fail attempts to pair if the remote device exchanges a public key with the same X coordinate as the locally exchanged public key

CVSS 3.1: 7.7 HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS: 1.21% probability · 67th percentile
CISA KEV: Not listed
Affected: microsoft/windows 10 · microsoft/windows server 2016 · microsoft/windows server 2019
Source: secure@microsoft.com

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.