VULNERABILITY INTELLIGENCE
CVE-2018-5383
CVSS score6.8 MEDIUM
EPSS probability0.81%
CISA KEVNot currently listed
Published2018-08-07
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Description
Bluetooth firmware or operating system software drivers in macOS versions before 10.13, High Sierra and iOS versions before 11.4, and Android versions before the 2018-06-05 patch may not sufficiently validate elliptic curve parameters used to generate public keys during a Diffie-Hellman key exchange, which may allow a remote attacker to obtain the encryption key used by the device.
Weakness classification
- CWE-325: Missing Cryptographic Step
- CWE-347: Improper Verification of Cryptographic Signature
Primary references
- cret@cert.org — Mitigation, Third Party Advisory
- cret@cert.org — Broken Link, Third Party Advisory, VDB Entry
- cret@cert.org — Broken Link, Third Party Advisory, VDB Entry
- cret@cert.org — Third Party Advisory
- cret@cert.org — Mailing List
- cret@cert.org — Third Party Advisory
- cret@cert.org — Third Party Advisory
- cret@cert.org — Third Party Advisory
- cret@cert.org — Third Party Advisory
- cret@cert.org — Third Party Advisory
- cret@cert.org — Broken Link, Vendor Advisory
- cret@cert.org — Third Party Advisory