CVE-2022-25837

What it actually does

Allows an adjacent unauthenticated attacker to perform a man-in-the-middle attack during Bluetooth BR/EDR pairing by forcing a mismatch between Secure Connections Passkey mode on one device and Legacy PIN code mode on the other, then brute-forcing the 6-digit value to obtain link keys.

Why it matters to the business

Organizations relying on Bluetooth for device connectivity face risk of credential theft and session hijacking on affected hardware, potentially exposing sensitive data flows or enabling unauthorized device control; the flaw has remained unpatched in the core specification for over three years with minimal observed exploitation.

How an attack unfolds

An attacker within radio range positions themselves between an Initiator using Secure Connections and a Responder still supporting Legacy PIN pairing, negotiates conflicting modes, captures the Passkey prompt, brute-forces the six-digit value, and re-uses it to complete authentication with the Initiator, ultimately deriving the resulting link key.

How to fix it

Disable BR/EDR Legacy PIN pairing on all devices where possible, enforce Secure Connections-only mode, and apply any vendor firmware updates that implement Bluetooth Core Specification errata addressing pairing method confusion; no specification-level fix exists.

How to confirm the fix worked

Audit device Bluetooth stacks and firmware for support of Legacy PIN pairing versus Secure Connections enforcement; test pairing flows in a lab environment while monitoring for mode-negotiation anomalies.

Typical attack path

1. Gain adjacent wireless proximity to both target devices during pairing
2. Force negotiation of Secure Connections Passkey with the Initiator and Legacy PIN with the Responder
3. Intercept the user-entered six-digit value and brute-force it offline
4. Replay the discovered value to complete pairing with the Initiator
5. Derive and store the resulting Bluetooth link key for future impersonation

How to detect it

Review Bluetooth controller logs and host stack traces for repeated or failed pairing attempts involving mixed Secure Connections and Legacy PIN modes; look for unexpected link-key derivation events shortly after pairing.

What your security team should do

• Inventory all Bluetooth-enabled assets and identify those permitting Legacy PIN pairing
• Configure devices to reject Legacy PIN and require Secure Connections where supported
• Monitor vendor advisories for any future errata or stack updates
• Consider network segmentation or additional encryption layers for sensitive Bluetooth traffic