CVE-2019-17061

MEDIUM 6.5CVE-2019-17061 · Published 10/02/2020 · updated 17/06/2026

In short

CVE-2019-17061 is a MEDIUM (CVSS 6.5) vulnerability affecting psoc 4 ble (cypress).
Chance of exploitation in the next 30 days (EPSS): 0.88%, higher than 59.2% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
psoc 4 ble cypress	`≤ 3.62`	No fix yet

Description

The Bluetooth Low Energy (BLE) stack implementation on Cypress PSoC 4 through 3.62 devices does not properly restrict the BLE Link Layer header and executes certain memory contents upon receiving a packet with a Link Layer ID (LLID) equal to zero. This allows attackers within radio range to cause deadlocks, cause anomalous behavior in the BLE state machine, or trigger a buffer overflow via a crafted BLE Link Layer frame.

References

asset-group.github.io/disclosures/sweyntooth · Third Party Advisory
community.cypress.com/thread/53680 · Vendor Advisory
cypress.com/products/ble-bluetooth · Vendor Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free