CVE-2019-9506: Blutooth BR/EDR specification does not specify sufficient encryption key length and allows an attacker to influence key length negotiation

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-08-14 · updated 2026-06-17
Weakness: CWE-310

Description

The Bluetooth BR/EDR specification up to and including version 5.1 permits sufficiently low encryption key length and does not prevent an attacker from influencing the key length negotiation. This allows practical brute-force attacks (aka "KNOB") that can decrypt traffic and inject arbitrary ciphertext without the victim noticing.

Affected products

Apple Iphone Os: 12.4
macOS: 10.12.6, 10.13.6, 10.14.5
Apple tvOS: 12.4
Apple watchOS: 5.3
Canonical Ubuntu Linux: 16.04, 18.04, 19.04
Debian Linux: 8.0
Android: all versions
Huawei Alp-Al00B Firmware: before 9.1.0.333\(c00e333r2p1t8\) — fixed in 9.1.0.333\(c00e333r2p1t8\)
Huawei Ares-Al00B Firmware: before 9.1.0.160\(c00e160r2p5t8\) — fixed in 9.1.0.160\(c00e160r2p5t8\)
Huawei Ares-Al10D Firmware: before 9.1.0.160\(c00e160r2p5t8\) — fixed in 9.1.0.160\(c00e160r2p5t8\)
Huawei Ares-Tl00C Firmware: before 9.1.0.165\(c01e165r2p5t8\) — fixed in 9.1.0.165\(c01e165r2p5t8\)
Huawei Asoka-Al00Ax Firmware: before 9.1.1.181\(c00e48r6p1\) — fixed in 9.1.1.181\(c00e48r6p1\)
Huawei Atomu-L33 Firmware: before 8.0.0.147\(c605custc605d1\) — fixed in 8.0.0.147\(c605custc605d1\)
Huawei Atomu-L41 Firmware: before 8.0.0.153\(c461custc461d1\) — fixed in 8.0.0.153\(c461custc461d1\)
Huawei Atomu-L42 Firmware: before 8.0.0.155\(c636custc636d1\) — fixed in 8.0.0.155\(c636custc636d1\)
Huawei Barca-Al00 Firmware: before 8.0.0.366\(c00\) — fixed in 8.0.0.366\(c00\)
Huawei Berkeley-Al20 Firmware: before 9.1.0.333\(c00e333r2p1t8\) — fixed in 9.1.0.333\(c00e333r2p1t8\)
Huawei Berkeley-L09 Firmware: before 9.1.0.332\(c432e5r1p13t8\); before 9.1.0.350\(c10e3r1p14t8\); before 9.1.0.350\(c636e4r1p13t8\) — fixed in 9.1.0.332\(c432e5r1p13t8\), 9.1.0.350\(c10e3r1p14t8\), 9.1.0.350\(c636e4r1p13t8\)
Huawei Berkeley-Tl10 Firmware: before 9.1.0.333\(c01e333r1p1t8\) — fixed in 9.1.0.333\(c01e333r1p1t8\)
Huawei Bla-Al00B Firmware: before 9.1.0.329\(c786e320r2p1t8\) — fixed in 9.1.0.329\(c786e320r2p1t8\)
Huawei Bla-L29C Firmware: before 9.1.0.300\(c605e2r1p12t8\); before 9.1.0.306\(c185e2r1p13t8\); before 9.1.0.306\(c432e4r1p11t8\); before 9.1.0.306\(c636e2r1p13t8\); before 9.1.0.307\(c635e4r1p13t8\) — fixed in 9.1.0.300\(c605e2r1p12t8\), 9.1.0.306\(c185e2r1p13t8\), 9.1.0.306\(c432e4r1p11t8\), 9.1.0.306\(c636e2r1p13t8\), 9.1.0.307\(c635e4r1p13t8\)
Huawei Bla-Tl00B Firmware: before 9.1.0.329\(c01e320r1p1t8\) — fixed in 9.1.0.329\(c01e320r1p1t8\)
Huawei Cairogo-L22 Firmware: before cairogo-l22c461b153 — fixed in cairogo-l22c461b153
Huawei Charlotte-L29C Firmware: before 9.1.0.311\(c605e2r1p11t8\); before 9.1.0.325\(c185e4r1p11t8\); before 9.1.0.325\(c636e2r1p12t8\); before 9.1.0.328\(c432e5r1p9t8\); before 9.1.0.328\(c782e10r1p9t8\) — fixed in 9.1.0.311\(c605e2r1p11t8\), 9.1.0.325\(c185e4r1p11t8\), 9.1.0.325\(c636e2r1p12t8\), 9.1.0.328\(c432e5r1p9t8\), 9.1.0.328\(c782e10r1p9t8\)
Huawei Columbia-Al10B Firmware: before 9.1.0.333\(c00e333r1p1t8\) — fixed in 9.1.0.333\(c00e333r1p1t8\)
Huawei Columbia-Al10I Firmware: before 9.1.0.335\(c675e8r1p9t8\) — fixed in 9.1.0.335\(c675e8r1p9t8\)
Huawei Columbia-L29D Firmware: before 9.1.0.350\(c10e5r1p14t8\); before 9.1.0.350\(c185e3r1p12t8\); before 9.1.0.350\(c461e3r1p11t8\); before 9.1.0.350\(c636e3r1p13t8\); before 9.1.0.351\(c432e5r1p13t8\) — fixed in 9.1.0.350\(c10e5r1p14t8\), 9.1.0.350\(c185e3r1p12t8\), 9.1.0.350\(c461e3r1p11t8\), 9.1.0.350\(c636e3r1p13t8\), 9.1.0.351\(c432e5r1p13t8\)
Huawei Columbia-Tl00D Firmware: before 8.1.0.186\(c01gt\) — fixed in 8.1.0.186\(c01gt\)
Huawei Cornell-Al00A Firmware: before 9.1.0.333\(c00e333r1p1t8\) — fixed in 9.1.0.333\(c00e333r1p1t8\)
Huawei Cornell-Al00I Firmware: before 9.1.0.363\(c675e3r1p9t8\) — fixed in 9.1.0.363\(c675e3r1p9t8\)

How to fix

Upgrade to a fixed version: Huawei Alp-Al00B Firmware 9.1.0.333\(c00e333r2p1t8\); Huawei Ares-Al00B Firmware 9.1.0.160\(c00e160r2p5t8\); Huawei Ares-Al10D Firmware 9.1.0.160\(c00e160r2p5t8\); Huawei Ares-Tl00C Firmware 9.1.0.165\(c01e165r2p5t8\); Huawei Asoka-Al00Ax Firmware 9.1.1.181\(c00e48r6p1\); Huawei Atomu-L33 Firmware 8.0.0.147\(c605custc605d1\); Huawei Atomu-L41 Firmware 8.0.0.153\(c461custc461d1\); Huawei Atomu-L42 Firmware 8.0.0.155\(c636custc636d1\); Huawei Barca-Al00 Firmware 8.0.0.366\(c00\); Huawei Berkeley-Al20 Firmware 9.1.0.333\(c00e333r2p1t8\); Huawei Berkeley-L09 Firmware 9.1.0.332\(c432e5r1p13t8\), 9.1.0.350\(c10e3r1p14t8\), 9.1.0.350\(c636e4r1p13t8\); Huawei Berkeley-Tl10 Firmware 9.1.0.333\(c01e333r1p1t8\). Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-9506 or the next vulnerability affects your stack