What’s Vulnerable › Vulnerabilities

CVE-2018-5383: Bluetooth implementations may not sufficiently validate elliptic curve parameters during Diffie-Hellman key exchange

• Severity: medium (CVSS 6.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-08-07 · updated 2026-06-17
• Weakness: CWE-325

Description

Bluetooth firmware or operating system software drivers in macOS versions before 10.13, High Sierra and iOS versions before 11.4, and Android versions before the 2018-06-05 patch may not sufficiently validate elliptic curve parameters used to generate public keys during a Diffie-Hellman key exchange, which may allow a remote attacker to obtain the encryption key used by the device.

Affected products

• Apple Iphone Os: before 11.4 — fixed in 11.4
• macOS: before 10.13 — fixed in 10.13
• Android: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0 (+1)
• Ti Wl18Xx Bluetooth Service Pack: before 4.3 — fixed in 4.3

How to fix

Upgrade to a fixed version: Apple Iphone Os 11.4; macOS 10.13; Ti Wl18Xx Bluetooth Service Pack 4.3. Check the vendor advisory for mitigations.

References

• http://www.cs.technion.ac.il/~biham/BT/
• http://www.securityfocus.com/bid/104879
• http://www.securitytracker.com/id/1041432
• https://access.redhat.com/errata/RHSA-2019:2169
• https://lists.debian.org/debian-lts-announce/2019/04/msg00005.html
• https://usn.ubuntu.com/4094-1/
• https://usn.ubuntu.com/4095-1/
• https://usn.ubuntu.com/4095-2/
• https://usn.ubuntu.com/4118-1/
• https://usn.ubuntu.com/4351-1/
• https://www.bluetooth.com/news/unknown/2018/07/bluetooth-sig-security-update
• https://www.kb.cert.org/vuls/id/304725

Get alerted when CVE-2018-5383 or the next vulnerability affects your stack