CVE-2019-16336

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-02-12 · updated 2026-06-17
Weakness: CWE-120

Description

The Bluetooth Low Energy implementation in Cypress PSoC 4 BLE component 3.61 and earlier processes data channel frames with a payload length larger than the configured link layer maximum RX payload size, which allows attackers (in radio range) to cause a denial of service (crash) via a crafted BLE Link Layer frame.

Affected products

Cypress Cybl11573: through 3.61
Cypress Cyble-416045: through 2.10

References

https://asset-group.github.io/disclosures/sweyntooth/
https://community.cypress.com/thread/48573
https://community.cypress.com/thread/53680
https://www.youtube.com/watch?v=Iw8sIBLWE_w
https://asset-group.github.io/disclosures/sweyntooth/
https://community.cypress.com/thread/48573
https://community.cypress.com/thread/53680
https://www.youtube.com/watch?v=Iw8sIBLWE_w

Get alerted when CVE-2019-16336 or the next vulnerability affects your stack