CVE-2020-13595

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-08-31 · updated 2026-06-17
Weakness: CWE-617

Description

The Bluetooth Low Energy (BLE) controller implementation in Espressif ESP-IDF 4.0 through 4.2 (for ESP32 devices) returns the wrong number of completed BLE packets and triggers a reachable assertion on the host stack when receiving a packet with an MIC failure. An attacker within radio range can silently trigger the assertion (which disables the target's BLE stack) by sending a crafted sequence of BLE packets.

Affected products

espressif esp-idf: from 4.0.0 through 4.2

References

https://asset-group.github.io/cves.html
https://asset-group.github.io/disclosures/sweyntooth/
https://github.com/espressif/esp32-bt-lib
https://asset-group.github.io/cves.html
https://asset-group.github.io/disclosures/sweyntooth/
https://github.com/espressif/esp32-bt-lib

Get alerted when CVE-2020-13595 or the next vulnerability affects your stack