Every CVE Search/ Get API key

CVE-2023-45866

Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate...

6.3 MediumPublic exploitFix available

Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, and accept HID keyboard reports, potentially permitting injection of HID messages when no user interaction has occurred in the Central role to authorize such access. An example affected package is bluez 5.64-0ubuntu1 in Ubuntu 22.04LTS. NOTE: in some cases, a CVE-2020-0556 mitigation would have already addressed this Bluetooth HID Hosts issue.

Attack profile

How easy it is to exploit

Attack vector
Adjacent network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
Low

Exploit likelihood

7.88%Up 7.8 points since Dec 8, 2023
90%50%10%1%

What each source reports

NVD Score used 6.3

Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, and accept HID keyboard reports, potentially permitting injection of HID messages when no user interaction has occurred in the Central role to authorize such access. An example affected package is bluez 5.64-0ubuntu1 in Ubuntu 22.04LTS. NOTE: in some cases, a CVE-2020-0556 mitigation would have already addressed this Bluetooth HID Hosts issue.

Record
CVE-2023-45866
CVSS 3.1
6.3 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-287
Updated
2026-11-02
CVE List No score

Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, and accept HID keyboard reports, potentially permitting injection of HID messages when no user interaction has occurred in the Central role to authorize such access. An example affected package is bluez 5.64-0ubuntu1 in Ubuntu 22.04LTS. NOTE: in some cases, a CVE-2020-0556 mitigation would have already addressed this Bluetooth HID Hosts issue.

Record
CVE-2023-45866
Updated
2026-11-02
EUVDEUVD-2023-50132 No score

Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, and accept HID keyboard reports, potentially permitting injection of HID messages when no user interaction has occurred in the Central role to authorize such access. An example affected package is bluez 5.64-0ubuntu1 in Ubuntu 22.04LTS. NOTE: in some cases, a CVE-2020-0556 mitigation would have already addressed this Bluetooth HID Hosts issue.

Record
EUVD-2023-50132
Updated
2026-11-02
GitHub AdvisoriesGHSA-qjcj-xg77-6c32 8.8

Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate...

Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, and accept HID keyboard reports, potentially permitting injection of HID messages when no user interaction has occurred in the Central role to authorize such access. An example affected package is bluez 5.64-0ubuntu1 in Ubuntu 22.04LTS. NOTE: in some cases, a CVE-2020-0556 mitigation would have already addressed this Bluetooth HID Hosts issue.

Record
GHSA-qjcj-xg77-6c32
CVSS 3.1
8.8 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-287
Updated
2026-11-02
OSVAZL-32161 6.3

CVE-2023-45866 affecting package bluez for versions less than 5.63-5

Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, and accept HID keyboard reports, potentially permitting injection of HID messages when no user interaction has occurred in the Central role to authorize such access. An example affected package is bluez 5.64-0ubuntu1 in Ubuntu 22.04LTS. NOTE: in some cases, a CVE-2020-0556 mitigation would have already addressed this Bluetooth HID Hosts issue.

Record
AZL-32161
CVSS 3.1
6.3 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVAZL-34571 6.3

CVE-2023-45866 affecting package bluez for versions less than 5.63-6

Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, and accept HID keyboard reports, potentially permitting injection of HID messages when no user interaction has occurred in the Central role to authorize such access. An example affected package is bluez 5.64-0ubuntu1 in Ubuntu 22.04LTS. NOTE: in some cases, a CVE-2020-0556 mitigation would have already addressed this Bluetooth HID Hosts issue.

Record
AZL-34571
CVSS 3.1
6.3 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-05
Show 20 moreShow less
OSVBELL-CVE-2023-45866 6.3
Record
BELL-CVE-2023-45866
CVSS 3.1
6.3 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSV 6.3

Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, and accept HID keyboard reports, potentially permitting injection of HID messages when no user interaction has occurred in the Central role to authorize such access. An example affected package is bluez 5.64-0ubuntu1 in Ubuntu 22.04LTS. NOTE: in some cases, a CVE-2020-0556 mitigation would have already addressed this Bluetooth HID Hosts issue.

Record
CVE-2023-45866
CVSS 3.1
6.3 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVDEBIAN-CVE-2023-45866 6.3

Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, and accept HID keyboard reports, potentially permitting injection of HID messages when no user interaction has occurred in the Central role to authorize such access. An example affected package is bluez 5.64-0ubuntu1 in Ubuntu 22.04LTS. NOTE: in some cases, a CVE-2020-0556 mitigation would have already addressed this Bluetooth HID Hosts issue.

Record
DEBIAN-CVE-2023-45866
CVSS 3.1
6.3 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVOESA-2023-1948 8.8

bluez security update

This package provides all utilities for use in Bluetooth applications. The BLUETOOTH trademarks are owned by Bluetooth SIG, Inc., U.S.A.

Security Fix(es):

Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, and accept HID keyboard reports, potentially permitting injection of HID messages when no user interaction has occurred in the Central role to authorize such access. An example affected package is bluez 5.64-0ubuntu1 in Ubuntu 22.04LTS. NOTE: in some cases, a CVE-2020-0556 mitigation would have already addressed this Bluetooth HID Hosts issue.(CVE-2023-45866)

Record
OESA-2023-1948
CVSS 3.1
8.8 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2024:11154 6.3

Red Hat Security Advisory: bluez security update

Record
RHSA-2024:11154
CVSS 3.1
6.3 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVRHSA-2024:9413 7.1

Red Hat Security Advisory: bluez security update

Record
RHSA-2024:9413
CVSS 3.1
7.1 HighCVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2023-45866 6.3

Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, and accept HID keyboard reports, potentially permitting injection of HID messages when no user interaction has occurred in the Central role to authorize such access. An example affected package is bluez 5.64-0ubuntu1 in Ubuntu 22.04LTS. NOTE: in some cases, a CVE-2020-0556 mitigation would have already addressed this Bluetooth HID Hosts issue.

Record
UBUNTU-CVE-2023-45866
CVSS 3.1
6.3 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVALSA-2024:11154 No score

Moderate: bluez security update

The bluez packages contain the following utilities for use in Bluetooth applications: hcitool, hciattach, hciconfig, bluetoothd, l2ping, start scripts (AlmaLinux), and pcmcia configuration files.

Security Fix(es):

  • bluez: unauthorized HID device connections allows keystroke injection and arbitrary commands execution (CVE-2023-45866)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2024:11154
Updated
2026-11-02
OSVALSA-2024:9413 No score

Moderate: bluez security update

The bluez packages contain the following utilities for use in Bluetooth applications: hcitool, hciattach, hciconfig, bluetoothd, l2ping, start scripts (AlmaLinux), and pcmcia configuration files.

Security Fix(es):

  • bluez: unauthorized HID device connections allows keystroke injection and arbitrary commands execution (CVE-2023-45866)
  • BlueZ: Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability (CVE-2023-27349)
  • bluez: phone book access profile heap-based buffer overflow remote code execution vulnerability (CVE-2023-51596)
  • bluez: OBEX library out-of-bounds read information disclosure vulnerability (CVE-2023-51594)
  • bluez: audio profile avrcp parse_media_folder out-of-bounds read information disclosure vulnerability (CVE-2023-51592)
  • bluez: audio profile avrcp parse_media_element out-of-bounds read information disclosure vulnerability (CVE-2023-51589)
  • bluez: avrcp_parse_attribute_list out-of-bounds read information disclosure vulnerability (CVE-2023-51580)
  • bluez: AVRCP stack-based buffer overflow remote code execution vulnerability (CVE-2023-44431)
  • bluez: phone book access profile heap-based buffer overflow remote code execution vulnerability (CVE-2023-50230)
  • bluez: phone book access profile heap-based buffer overflow remote code execution vulnerability (CVE-2023-50229)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Record
ALSA-2024:9413
Updated
2026-11-02
OSVASB-A-294854926 No score

In multiple locations, there is a possible way to inject keystrokes due to improper input validation. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Record
ASB-A-294854926
Updated
2026-11-05
OSVCLSA-2025-1763031616 No score

bluez: Fix of 10 CVEs

  • CVE-2023-27349: fix crash while handling unsupported events in avrcp
  • CVE-2023-44431: fix Stack-based buffer overflow and remote code execution vulnerability
  • CVE-2023-45866: restrict HID connections to avoid unauthorized input injection
  • CVE-2023-50229: fix heap-based buffer overflow vulnerability in handling Phone Book Access profile by adding proper validation of user-supplied data length before copying to buffer
  • CVE-2023-50230: fix heap-based buffer overflow vulnerability in Phone Book Access profile to prevent arbitrary code execution by validating user-supplied data length before copying to buffer
  • CVE-2023-51580: validate AVRCP attribute list data to prevent out-of-bounds reads and information disclosure
  • CVE-2023-51589: validate AVRCP media element data to prevent out-of-bounds reads and information disclosure
  • CVE-2023-51592: validate AVRCP media folder data to prevent out-of-bounds reads and information disclosure
  • CVE-2023-51594: validate OBEX protocol parameters to prevent out-of-bounds reads and information disclosure
  • CVE-2023-51596: validate PBAP data length to prevent heap overflow and remote code execution
Record
CLSA-2025-1763031616
Updated
2026-11-02
OSVMGASA-2023-0353 No score

Updated bluez packages fix a security vulnerability

This update fixes the following security issue. Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, and accept HID keyboard reports, potentially permitting injection of HID messages when no user interaction has occurred in the Central role to authorize such access (CVE-2023-45866).

Record
MGASA-2023-0353
Updated
2026-11-02
OSVopenSUSE-SU-2024:13507-1 No score

bluez-5.70-2.1 on GA media

These are all security issues fixed in the bluez-5.70-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13507-1
Updated
2026-11-02
OSVRLSA-2024:9413 No score

Moderate: bluez security update

The bluez packages contain the following utilities for use in Bluetooth applications: hcitool, hciattach, hciconfig, bluetoothd, l2ping, start scripts (Rocky Enterprise Software Foundation), and pcmcia configuration files.

Security Fix(es):

  • bluez: unauthorized HID device connections allows keystroke injection and arbitrary commands execution (CVE-2023-45866)

  • BlueZ: Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability (CVE-2023-27349)

  • bluez: phone book access profile heap-based buffer overflow remote code execution vulnerability (CVE-2023-51596)

  • bluez: OBEX library out-of-bounds read information disclosure vulnerability (CVE-2023-51594)

  • bluez: audio profile avrcp parse_media_folder out-of-bounds read information disclosure vulnerability (CVE-2023-51592)

  • bluez: audio profile avrcp parse_media_element out-of-bounds read information disclosure vulnerability (CVE-2023-51589)

  • bluez: avrcp_parse_attribute_list out-of-bounds read information disclosure vulnerability (CVE-2023-51580)

  • bluez: AVRCP stack-based buffer overflow remote code execution vulnerability (CVE-2023-44431)

  • bluez: phone book access profile heap-based buffer overflow remote code execution vulnerability (CVE-2023-50230)

  • bluez: phone book access profile heap-based buffer overflow remote code execution vulnerability (CVE-2023-50229)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9.5 Release Notes linked from the References section.

Record
RLSA-2024:9413
Updated
2026-11-02
OSVSUSE-SU-2025:03269-1 No score

Security update for bluez

This update for bluez fixes the following issues:

  • CVE-2023-45866: keystroke injection and arbitrary command execution via HID device connections (bsc#1217877).
Record
SUSE-SU-2025:03269-1
Updated
2026-11-02
OSVSUSE-SU-2025:03277-1 No score

Security update for bluez

This update for bluez fixes the following issues:

  • CVE-2023-45866: keystroke injection and arbitrary command execution via HID device connections (bsc#1217877).
Record
SUSE-SU-2025:03277-1
Updated
2026-11-02
OSVSUSE-SU-2025:03590-1 No score

Security update for bluez

This update for bluez fixes the following issues:

  • CVE-2023-45866: keystroke injection and arbitrary command execution via HID device connections (bsc#1217877).
Record
SUSE-SU-2025:03590-1
Updated
2026-11-02
OSVSUSE-SU-2025:20804-1 No score

Security update for bluez

This update for bluez fixes the following issues:

  • CVE-2023-45866: Fixed unauthorized HID device connections allowing keystroke injection and arbitrary commands execution (bsc#1217877)
Record
SUSE-SU-2025:20804-1
Updated
2026-11-02
OSVSUSE-SU-2026:20041-1 No score

Security update for bluez

This update for bluez fixes the following issues:

  • CVE-2023-45866: keystroke injection and arbitrary command execution via HID device connections (bsc#1217877).
Record
SUSE-SU-2026:20041-1
Updated
2026-11-02
OSVUSN-6540-1 No score

bluez vulnerability

It was discovered that BlueZ did not properly restrict non-bonded devices from injecting HID events into the input subsystem. This could allow a physically proximate attacker to inject keystrokes and execute arbitrary commands whilst the device is discoverable.

Record
USN-6540-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
bluez
AlmaLinux:8
 before 5.63-3.el8_10.alma.1
5.63-3.el8_10.alma.1
bluez-cups
AlmaLinux:8
 before 5.63-3.el8_10.alma.1
5.63-3.el8_10.alma.1
bluez-hid2hci
AlmaLinux:8
 before 5.63-3.el8_10.alma.1
5.63-3.el8_10.alma.1
bluez-libs
AlmaLinux:8
 before 5.63-3.el8_10.alma.1
5.63-3.el8_10.alma.1
bluez-libs-devel
AlmaLinux:8
 before 5.63-3.el8_10.alma.1
5.63-3.el8_10.alma.1
bluez-obexd
AlmaLinux:8
 before 5.63-3.el8_10.alma.1
5.63-3.el8_10.alma.1
bluez
AlmaLinux:9
From an advisory covering 10 CVEs
 before 5.72-2.el9
5.72-2.el9
bluez-cups
AlmaLinux:9
From an advisory covering 10 CVEs
 before 5.72-2.el9
5.72-2.el9
bluez-libs
AlmaLinux:9
From an advisory covering 10 CVEs
 before 5.72-2.el9
5.72-2.el9
bluez-libs-devel
AlmaLinux:9
From an advisory covering 10 CVEs
 before 5.72-2.el9
5.72-2.el9
Show 92 moreShow less
Affected packages
PackageAffectedFixed
bluez-obexd
AlmaLinux:9
From an advisory covering 10 CVEs
 before 5.72-2.el9
5.72-2.el9
platform/packages/modules/Bluetooth
Android
 14-next:0 up to 14-next:2023-12-05, plus listed versions
14-next
14-next:2023-12-05
platform/packages/modules/Bluetooth
Android
 13:0 up to 13:2023-12-05, plus listed versions
13
13:2023-12-05
platform/packages/modules/Bluetooth
Android
 14:0 up to 14:2023-12-05, plus listed versions
14
14:2023-12-05
bluez
Azure Linux:2
 before 5.63-5
5.63-5
bluez
Azure Linux:3
 before 5.63-6
5.63-6
bluez
Alpaquita:23
 5.66-r1 up to 5.66-r2
5.66-r2
bluez
TuxCare:AlmaLinux:9.2
From an advisory covering 10 CVEs
 before 5.72-4.el9.tuxcare.els1
5.72-4.el9.tuxcare.els1
bluez-cups
TuxCare:AlmaLinux:9.2
From an advisory covering 10 CVEs
 before 5.72-4.el9.tuxcare.els1
5.72-4.el9.tuxcare.els1
bluez-hid2hci
TuxCare:AlmaLinux:9.2
From an advisory covering 10 CVEs
 before 5.72-4.el9.tuxcare.els1
5.72-4.el9.tuxcare.els1
bluez-libs
TuxCare:AlmaLinux:9.2
From an advisory covering 10 CVEs
 before 5.72-4.el9.tuxcare.els1
5.72-4.el9.tuxcare.els1
bluez-libs-devel
TuxCare:AlmaLinux:9.2
From an advisory covering 10 CVEs
 before 5.72-4.el9.tuxcare.els1
5.72-4.el9.tuxcare.els1
bluez-mesh
TuxCare:AlmaLinux:9.2
From an advisory covering 10 CVEs
 before 5.72-4.el9.tuxcare.els1
5.72-4.el9.tuxcare.els1
bluez-obexd
TuxCare:AlmaLinux:9.2
From an advisory covering 10 CVEs
 before 5.72-4.el9.tuxcare.els1
5.72-4.el9.tuxcare.els1
bluez
Debian:12
 before 5.66-1+deb12u1, plus listed versions
5.66-1
5.66-1+deb12u1
bluez
Debian:13
 before 5.70-1.1
5.70-1.1
bluez
Debian:14
 before 5.70-1.1
5.70-1.1
bluez
Debian:10
 before 5.50-1.2~deb10u4, plus listed versions
5.50-15.50-1.15.50-1.2~deb10u15.50-1.2~deb10u25.50-1.2~deb10u3
5.50-1.2~deb10u4
bluez
Debian:11
 before 5.55-3.1+deb11u1, plus listed versions
5.55-3.1
5.55-3.1+deb11u1
bluez
Mageia:9
 before 5.70-1.mga9
5.70-1.mga9
bluez
openEuler:20.03-LTS-SP1
 before 5.54-13.oe1
5.54-13.oe1
bluez
openEuler:20.03-LTS-SP3
 before 5.54-13.oe1
5.54-13.oe1
bluez
openEuler:20.03-LTS-SP4
 before 5.54-13.oe2003sp4
5.54-13.oe2003sp4
bluez
openEuler:22.03-LTS
 before 5.54-18.oe2203sp2
5.54-18.oe2203sp2
bluez
openEuler:22.03-LTS-SP1
 before 5.54-18.oe2203sp1
5.54-18.oe2203sp1
bluez
openEuler:22.03-LTS-SP2
 before 5.54-18.oe2203sp2
5.54-18.oe2203sp2
bluez-cups
Red Hat:enterprise_linux:8::appstream
 before 0:5.63-3.el8_10
0:5.63-3.el8_10
bluez-cups-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:5.63-3.el8_10
0:5.63-3.el8_10
bluez-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:5.63-3.el8_10
0:5.63-3.el8_10
bluez-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:5.63-3.el8_10
0:5.63-3.el8_10
bluez-hid2hci-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:5.63-3.el8_10
0:5.63-3.el8_10
bluez-libs-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:5.63-3.el8_10
0:5.63-3.el8_10
bluez-obexd-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:5.63-3.el8_10
0:5.63-3.el8_10
bluez
Red Hat:enterprise_linux:8::baseos
 before 0:5.63-3.el8_10
0:5.63-3.el8_10
bluez-cups-debuginfo
Red Hat:enterprise_linux:8::baseos
 before 0:5.63-3.el8_10
0:5.63-3.el8_10
bluez-debuginfo
Red Hat:enterprise_linux:8::baseos
 before 0:5.63-3.el8_10
0:5.63-3.el8_10
bluez-debugsource
Red Hat:enterprise_linux:8::baseos
 before 0:5.63-3.el8_10
0:5.63-3.el8_10
bluez-hid2hci
Red Hat:enterprise_linux:8::baseos
 before 0:5.63-3.el8_10
0:5.63-3.el8_10
bluez-hid2hci-debuginfo
Red Hat:enterprise_linux:8::baseos
 before 0:5.63-3.el8_10
0:5.63-3.el8_10
bluez-libs
Red Hat:enterprise_linux:8::baseos
 before 0:5.63-3.el8_10
0:5.63-3.el8_10
bluez-libs-debuginfo
Red Hat:enterprise_linux:8::baseos
 before 0:5.63-3.el8_10
0:5.63-3.el8_10
bluez-obexd
Red Hat:enterprise_linux:8::baseos
 before 0:5.63-3.el8_10
0:5.63-3.el8_10
bluez-obexd-debuginfo
Red Hat:enterprise_linux:8::baseos
 before 0:5.63-3.el8_10
0:5.63-3.el8_10
bluez-cups-debuginfo
Red Hat:enterprise_linux:8::crb
 before 0:5.63-3.el8_10
0:5.63-3.el8_10
bluez-debuginfo
Red Hat:enterprise_linux:8::crb
 before 0:5.63-3.el8_10
0:5.63-3.el8_10
bluez-debugsource
Red Hat:enterprise_linux:8::crb
 before 0:5.63-3.el8_10
0:5.63-3.el8_10
bluez-hid2hci-debuginfo
Red Hat:enterprise_linux:8::crb
 before 0:5.63-3.el8_10
0:5.63-3.el8_10
bluez-libs-debuginfo
Red Hat:enterprise_linux:8::crb
 before 0:5.63-3.el8_10
0:5.63-3.el8_10
bluez-libs-devel
Red Hat:enterprise_linux:8::crb
 before 0:5.63-3.el8_10
0:5.63-3.el8_10
bluez-obexd-debuginfo
Red Hat:enterprise_linux:8::crb
 before 0:5.63-3.el8_10
0:5.63-3.el8_10
bluez-cups
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-cups-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-hid2hci-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-libs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-libs-devel-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-mesh-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-obexd
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-obexd-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez
Red Hat:enterprise_linux:9::baseos
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-cups-debuginfo
Red Hat:enterprise_linux:9::baseos
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-debuginfo
Red Hat:enterprise_linux:9::baseos
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-debugsource
Red Hat:enterprise_linux:9::baseos
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-hid2hci-debuginfo
Red Hat:enterprise_linux:9::baseos
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-libs
Red Hat:enterprise_linux:9::baseos
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-libs-debuginfo
Red Hat:enterprise_linux:9::baseos
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-libs-devel-debuginfo
Red Hat:enterprise_linux:9::baseos
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-mesh-debuginfo
Red Hat:enterprise_linux:9::baseos
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-obexd-debuginfo
Red Hat:enterprise_linux:9::baseos
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-cups-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-debugsource
Red Hat:enterprise_linux:9::crb
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-hid2hci-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-libs-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-libs-devel
Red Hat:enterprise_linux:9::crb
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-libs-devel-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-mesh-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez-obexd-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez
Rocky Linux:9
From an advisory covering 10 CVEs
 before 0:5.72-2.el9
0:5.72-2.el9
bluez
SUSE:Linux Enterprise Micro 5.5
 before 5.65-150500.3.14.1
5.65-150500.3.14.1
bluez
SUSE:Linux Enterprise Micro 5.3
 before 5.62-150400.4.22.1
5.62-150400.4.22.1
bluez
SUSE:Linux Enterprise Micro 5.4
 before 5.62-150400.4.22.1
5.62-150400.4.22.1
bluez
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
 before 5.13-5.45.1
5.13-5.45.1
bluez
SUSE:Linux Micro 6.1
 before 5.70-slfo.1.1_2.1
5.70-slfo.1.1_2.1
bluez
SUSE:Linux Micro 6.0
 before 5.70-2.1
5.70-2.1
bluez
Ubuntu:Pro:16.04:LTS
 before 5.37-0ubuntu5.3+esm3, plus listed versions
5.35-0ubuntu25.36-0ubuntu15.37-0ubuntu55.37-0ubuntu5.15.37-0ubuntu5.35.37-0ubuntu5.3+esm15.37-0ubuntu5.3+esm2
5.37-0ubuntu5.3+esm3
bluez
Ubuntu:Pro:18.04:LTS
 before 5.48-0ubuntu3.9+esm1, plus listed versions
5.46-0ubuntu35.46-0ubuntu45.48-0ubuntu35.48-0ubuntu3.15.48-0ubuntu3.2
Show 7 moreShow less
5.48-0ubuntu3.35.48-0ubuntu3.45.48-0ubuntu3.55.48-0ubuntu3.65.48-0ubuntu3.75.48-0ubuntu3.85.48-0ubuntu3.9
5.48-0ubuntu3.9+esm1
bluez
Ubuntu:20.04:LTS
 before 5.53-0ubuntu3.7, plus listed versions
5.50-0ubuntu45.51-0ubuntu15.51-0ubuntu25.52-0ubuntu15.52-0ubuntu2
Show 9 moreShow less
5.53-0ubuntu15.53-0ubuntu25.53-0ubuntu35.53-0ubuntu3.15.53-0ubuntu3.25.53-0ubuntu3.35.53-0ubuntu3.45.53-0ubuntu3.55.53-0ubuntu3.6
5.53-0ubuntu3.7
bluez
Ubuntu:22.04:LTS
 before 5.64-0ubuntu1.1, plus listed versions
5.60-0ubuntu25.62-0ubuntu15.62-0ubuntu25.63-0ubuntu15.63-0ubuntu25.64-0ubuntu1
5.64-0ubuntu1.1
bluez
Ubuntu:24.04:LTS
 before 5.70-0ubuntu3, plus listed versions
5.68-0ubuntu15.70-0ubuntu15.70-0ubuntu2
5.70-0ubuntu3
bluez
openSUSE:Tumbleweed
 before 5.70-2.1
5.70-2.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubEason-zz/BluetoothDucky2024-01-16
PoC in GitHubpentestfunctions/BlueDucky2024-01-16
PoC in GitHubjjjjjjjj987/cve-2023-45866-py2024-01-23
PoC in GitHubcisnarfu/Bluepop2024-06-29
PoC in GitHubAvishekDhakal/CVE-2023-45866_EXPLOITS2024-09-02
PoC in GitHubChedrian07/CVE-2023-45866-POC2024-10-09
PoC in GitHubDanyw24/blueXploit2024-12-15
PoC in GitHubxG3nesis/RustyInjector2024-12-20
PoC in GitHubv3ilsm1th/CVE-2023-45866_WIP2025-03-27
PoC in GitHubSergeb250/BlueDucky2025-08-26
PoC in GitHubhegaz0y/-BuL2026-05-31
PoC in GitHubKiroShehata/CVE-2023-45866-Bluetooth-Security-Research2026-10-05

History

History
RecordedChangedSources
affectedOSV
exploits, factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-45866 is a medium vulnerability (CVSS 6.3) in Apple Ipados, published December 1, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 7.88%, the 94th percentile. Fixed in bluez 5.63-3.el8_10.alma.1.

References

Show 91 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open