CVE-2022-25836

What it actually does

The flaw permits an adjacent unauthenticated attacker to perform a man-in-the-middle attack during Bluetooth Low Energy pairing by negotiating Legacy Passkey Pairing with the initiator and Secure Connections Passkey Pairing with the responder, then brute-forcing the passkey entered on the initiator to complete authentication with the responder.

Why it matters to the business

Organizations relying on Bluetooth-enabled devices face potential exposure of pairing credentials leading to unauthorized device access or communication interception; the issue affects a broad ecosystem of wireless products with no vendor patches available and low but persistent exploitation likelihood.

How an attack unfolds

An attacker positioned within Bluetooth range intercepts a pairing exchange, forces mismatched pairing methods on each endpoint, observes the passkey entry on the initiator, brute-forces the six-digit value, and completes authentication with the responder to establish a trusted connection.

How to fix it

Disable Legacy Passkey Pairing and enforce Secure Connections pairing only; implement out-of-band passkey verification or numeric comparison methods; monitor Bluetooth stack updates from chipset and device vendors for any specification-compliant mitigations.

How to confirm the fix worked

Audit Bluetooth pairing configuration logs and supported methods on affected devices; verify that legacy passkey entry is disabled and only Secure Connections methods are accepted; test pairing attempts under simulated adjacent attacker conditions.

Typical attack path

1. Position adjacent to two devices performing Bluetooth Low Energy pairing
2. Negotiate Legacy Passkey Pairing with the initiator while forcing Secure Connections Passkey Pairing with the responder
3. Capture the passkey entry on the initiator and brute-force the value
4. Use the recovered passkey to finish authentication with the responder
5. Establish a trusted MITM session between the two devices

How to detect it

Review Bluetooth host and controller logs for mismatched pairing method negotiations, repeated failed passkey attempts during pairing, or unexpected successful pairings from unknown addresses; correlate with adjacent device discovery events.

What your security team should do

• Immediately review and restrict Bluetooth pairing configurations to Secure Connections only across all managed devices
• Prioritize inventory of Bluetooth devices using affected specification versions and apply vendor firmware updates when released
• Implement network segmentation and monitoring for unauthorized Bluetooth pairings in high-risk environments
• Educate users on avoiding passkey entry when legacy methods are detected