CyberRota Analysis
AI-GeneratedArduinoBLE versions prior to 2.0.2 are vulnerable due to a missing bounds check in the ATT layer write request handler, which allows remote, unauthenticated Bluetooth Low Energy clients to corrupt memory. This vulnerability can lead to potential denial of service or arbitrary code execution on affected devices. Organizations utilizing Arduino models with BLEEncryption configured should prioritize updating to version 2.0.2 or later to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
ArduinoBLE enables Bluetooth Low Energy connectivity on certain Arduino models. Versions prior to 2.0.2 contain a missing bounds check in the ATT layer write request handler that allows a remote, unauthenticated BLE client to corrupt memory in the ATTClass global object. Devices running ArduinoBLE with one or more characteristics configured with the BLEEncryption property are affected. The fix is included starting from the 2.0.2 release.