CVE-2022-24695

What it actually does

Bluetooth Classic implementations through version 5.3 fail to properly suppress device identifiers when operating in Non-Discoverable mode, allowing an adjacent attacker to extract the permanent Bluetooth MAC address, device capabilities, and other identifiers via an efficient over-the-air probe.

Why it matters to the business

Organizations relying on Bluetooth devices for wireless peripherals, IoT sensors, or mobile connectivity face increased risk of long-term device tracking and targeted reconnaissance, which can undermine user privacy controls and complicate asset management across large fleets.

How an attack unfolds

An attacker within radio range silently sends crafted Bluetooth Classic inquiry and paging packets to a target in Non-Discoverable mode; the device leaks its permanent MAC address and capability information; the attacker then uses the obtained address to initiate a direct connection and gather additional identifying data.

How to fix it

Apply any future Bluetooth Core Specification updates that address the leakage; until then, disable Bluetooth when not required, enforce pairing only with trusted devices, and consider hardware or firmware mitigations that randomize or suppress the public MAC address where supported by the chipset.

How to confirm the fix worked

Confirm exposure by testing Non-Discoverable devices with over-the-air Bluetooth inquiry tools that attempt to retrieve the public address; verify that firmware or specification updates prevent leakage before declaring the population remediated.

Typical attack path

1. Position within Bluetooth radio range of the target
2. Transmit crafted inquiry and paging frames that bypass Non-Discoverable mode protections
3. Capture the permanent MAC address and device capability responses
4. Establish a direct Bluetooth connection using the extracted address
5. Harvest additional identifiers that may link the device to its owner

How to detect it

Look for repeated Bluetooth inquiry or paging traffic from unknown sources in wireless packet captures; correlate with device logs showing unexpected connection attempts from previously unseen MAC addresses.

What your security team should do

• Inventory all Bluetooth Classic devices and note those lacking mitigations
• Prioritize disabling Bluetooth on devices that do not require continuous discoverability
• Monitor vendor announcements for specification or chipset fixes and schedule updates
• Implement compensating controls such as MAC address randomization where hardware permits