Every CVE Search/ Get API key

CVE-2018-10910

A bug in Bluez may allow for the Bluetooth Discoverable state being set to on when no Bluetooth...

4.5 MediumFix available

A bug in Bluez may allow for the Bluetooth Discoverable state being set to on when no Bluetooth agent is registered with the system. This situation could lead to the unauthorized pairing of certain Bluetooth devices without any form of authentication. Versions before bluez 5.51 are vulnerable.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
Low

Exploit likelihood

0.46%Down 0.2 points since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List Score used 4.5

A bug in Bluez may allow for the Bluetooth Discoverable state being set to on when no Bluetooth agent is registered with the system. This situation could lead to the unauthorized pairing of certain Bluetooth devices without any form of authentication. Versions before bluez 5.51 are vulnerable.

Record
CVE-2018-10910
CVSS 3.0
4.5 MediumCVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
Weakness
CWE-863
Updated
2026-11-02
EUVDEUVD-2018-2966 4.5

A bug in Bluez may allow for the Bluetooth Discoverable state being set to on when no Bluetooth agent is registered with the system. This situation could lead to the unauthorized pairing of certain Bluetooth devices without any form of authentication. Versions before bluez 5.51 are vulnerable.

Record
EUVD-2018-2966
CVSS 3.0
4.5 MediumCVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
Updated
2026-11-03
GitHub AdvisoriesGHSA-62rf-fp64-gxpc 3.3

A bug in Bluez may allow for the Bluetooth Discoverable state being set to on when no Bluetooth...

A bug in Bluez may allow for the Bluetooth Discoverable state being set to on when no Bluetooth agent is registered with the system. This situation could lead to the unauthorized pairing of certain Bluetooth devices without any form of authentication. Versions before bluez 5.51 are vulnerable.

Record
GHSA-62rf-fp64-gxpc
CVSS 3.0
3.3 LowCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-863
Updated
2026-11-02
NVD 4.5

A bug in Bluez may allow for the Bluetooth Discoverable state being set to on when no Bluetooth agent is registered with the system. This situation could lead to the unauthorized pairing of certain Bluetooth devices without any form of authentication. Versions before bluez 5.51 are vulnerable.

Record
CVE-2018-10910
CVSS 3.0
4.5 MediumCVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
CVSS 3.0
3.3 LowCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0
2.1 LowAV:L/AC:L/Au:N/C:P/I:N/A:N
Weakness
CWE-863
Updated
2026-11-02
OSV 3.3

A bug in Bluez may allow for the Bluetooth Discoverable state being set to on when no Bluetooth agent is registered with the system. This situation could lead to the unauthorized pairing of certain Bluetooth devices without any form of authentication. Versions before bluez 5.51 are vulnerable.

Record
CVE-2018-10910
CVSS 3.0
3.3 LowCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2018-10910 3.3

A bug in Bluez may allow for the Bluetooth Discoverable state being set to on when no Bluetooth agent is registered with the system. This situation could lead to the unauthorized pairing of certain Bluetooth devices without any form of authentication. Versions before bluez 5.51 are vulnerable.

Record
DEBIAN-CVE-2018-10910
CVSS 3.0
3.3 LowCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
Show 5 moreShow less
OSVRHSA-2020:1101 4.5

Red Hat Security Advisory: bluez security update

Record
RHSA-2020:1101
CVSS 3.0
4.5 MediumCVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVRHSA-2020:1912 4.5

Red Hat Security Advisory: bluez security update

Record
RHSA-2020:1912
CVSS 3.0
4.5 MediumCVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2018-10910 3.3

A bug in Bluez may allow for the Bluetooth Discoverable state being set to on when no Bluetooth agent is registered with the system. This situation could lead to the unauthorized pairing of certain Bluetooth devices without any form of authentication. Versions before bluez 5.51 are vulnerable.

Record
UBUNTU-CVE-2018-10910
CVSS 3.0
3.3 LowCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS 3.0
4.5 MediumCVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVMGASA-2020-0152 No score

Updated bluez packages fix security vulnerabilities

The updated packages fix security vulnerabilities:

A bug in Bluez may allow for the Bluetooth Discoverable state being set to on when no Bluetooth agent is registered with the system. This situation could lead to the unauthorized pairing of certain Bluetooth devices without any form of authentication. Versions before bluez 5.51 are vulnerable. (CVE-2018-10910)

Improper access control in subsystem for BlueZ before version 5.54 may allow an unauthenticated user to potentially enable escalation of privilege and denial of service via adjacent access. (CVE-2020-0556)

Record
MGASA-2020-0152
Updated
2026-11-02
OSVUSN-3856-1 No score

gnome-bluetooth vulnerability

Chris Marchesi discovered that BlueZ incorrectly handled disabling Bluetooth visibility. A remote attacker could possibly pair to devices, contrary to expectations. This update adds a workaround to GNOME Bluetooth to fix the issue.

Record
USN-3856-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
bluez
Debian:12
 before 5.54-1
5.54-1
bluez
Debian:13
 before 5.54-1
5.54-1
bluez
Debian:14
 before 5.54-1
5.54-1
bluez
Mageia:7
From an advisory covering 2 CVEs
 before 5.54-1.mga7
5.54-1.mga7
bluez
Red Hat:enterprise_linux:7::client
 before 0:5.44-6.el7
0:5.44-6.el7
bluez-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:5.44-6.el7
0:5.44-6.el7
bluez-libs
Red Hat:enterprise_linux:7::client
 before 0:5.44-6.el7
0:5.44-6.el7
bluez-cups
Red Hat:enterprise_linux:7::client
 before 0:5.44-6.el7
0:5.44-6.el7
bluez-hid2hci
Red Hat:enterprise_linux:7::client
 before 0:5.44-6.el7
0:5.44-6.el7
bluez-libs-devel
Red Hat:enterprise_linux:7::client
 before 0:5.44-6.el7
0:5.44-6.el7
Show 45 moreShow less
Affected packages
PackageAffectedFixed
bluez
Red Hat:enterprise_linux:7::computenode
 before 0:5.44-6.el7
0:5.44-6.el7
bluez-debuginfo
Red Hat:enterprise_linux:7::computenode
 before 0:5.44-6.el7
0:5.44-6.el7
bluez-libs
Red Hat:enterprise_linux:7::computenode
 before 0:5.44-6.el7
0:5.44-6.el7
bluez-cups
Red Hat:enterprise_linux:7::computenode
 before 0:5.44-6.el7
0:5.44-6.el7
bluez-hid2hci
Red Hat:enterprise_linux:7::computenode
 before 0:5.44-6.el7
0:5.44-6.el7
bluez-libs-devel
Red Hat:enterprise_linux:7::computenode
 before 0:5.44-6.el7
0:5.44-6.el7
bluez
Red Hat:enterprise_linux:7::server
 before 0:5.44-6.el7
0:5.44-6.el7
bluez-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:5.44-6.el7
0:5.44-6.el7
bluez-libs
Red Hat:enterprise_linux:7::server
 before 0:5.44-6.el7
0:5.44-6.el7
bluez-cups
Red Hat:enterprise_linux:7::server
 before 0:5.44-6.el7
0:5.44-6.el7
bluez-hid2hci
Red Hat:enterprise_linux:7::server
 before 0:5.44-6.el7
0:5.44-6.el7
bluez-libs-devel
Red Hat:enterprise_linux:7::server
 before 0:5.44-6.el7
0:5.44-6.el7
bluez
Red Hat:enterprise_linux:7::workstation
 before 0:5.44-6.el7
0:5.44-6.el7
bluez-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:5.44-6.el7
0:5.44-6.el7
bluez-libs
Red Hat:enterprise_linux:7::workstation
 before 0:5.44-6.el7
0:5.44-6.el7
bluez-cups
Red Hat:enterprise_linux:7::workstation
 before 0:5.44-6.el7
0:5.44-6.el7
bluez-hid2hci
Red Hat:enterprise_linux:7::workstation
 before 0:5.44-6.el7
0:5.44-6.el7
bluez-libs-devel
Red Hat:enterprise_linux:7::workstation
 before 0:5.44-6.el7
0:5.44-6.el7
bluez-cups
Red Hat:enterprise_linux:8::appstream
 before 0:5.50-3.el8
0:5.50-3.el8
bluez-cups-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:5.50-3.el8
0:5.50-3.el8
bluez-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:5.50-3.el8
0:5.50-3.el8
bluez-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:5.50-3.el8
0:5.50-3.el8
bluez-hid2hci-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:5.50-3.el8
0:5.50-3.el8
bluez-libs-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:5.50-3.el8
0:5.50-3.el8
bluez-obexd-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:5.50-3.el8
0:5.50-3.el8
bluez
Red Hat:enterprise_linux:8::baseos
 before 0:5.50-3.el8
0:5.50-3.el8
bluez-cups-debuginfo
Red Hat:enterprise_linux:8::baseos
 before 0:5.50-3.el8
0:5.50-3.el8
bluez-debuginfo
Red Hat:enterprise_linux:8::baseos
 before 0:5.50-3.el8
0:5.50-3.el8
bluez-debugsource
Red Hat:enterprise_linux:8::baseos
 before 0:5.50-3.el8
0:5.50-3.el8
bluez-hid2hci
Red Hat:enterprise_linux:8::baseos
 before 0:5.50-3.el8
0:5.50-3.el8
bluez-hid2hci-debuginfo
Red Hat:enterprise_linux:8::baseos
 before 0:5.50-3.el8
0:5.50-3.el8
bluez-libs
Red Hat:enterprise_linux:8::baseos
 before 0:5.50-3.el8
0:5.50-3.el8
bluez-libs-debuginfo
Red Hat:enterprise_linux:8::baseos
 before 0:5.50-3.el8
0:5.50-3.el8
bluez-obexd
Red Hat:enterprise_linux:8::baseos
 before 0:5.50-3.el8
0:5.50-3.el8
bluez-obexd-debuginfo
Red Hat:enterprise_linux:8::baseos
 before 0:5.50-3.el8
0:5.50-3.el8
bluez-cups-debuginfo
Red Hat:enterprise_linux:8::crb
 before 0:5.50-3.el8
0:5.50-3.el8
bluez-debuginfo
Red Hat:enterprise_linux:8::crb
 before 0:5.50-3.el8
0:5.50-3.el8
bluez-debugsource
Red Hat:enterprise_linux:8::crb
 before 0:5.50-3.el8
0:5.50-3.el8
bluez-hid2hci-debuginfo
Red Hat:enterprise_linux:8::crb
 before 0:5.50-3.el8
0:5.50-3.el8
bluez-libs-debuginfo
Red Hat:enterprise_linux:8::crb
 before 0:5.50-3.el8
0:5.50-3.el8
bluez-libs-devel
Red Hat:enterprise_linux:8::crb
 before 0:5.50-3.el8
0:5.50-3.el8
bluez-obexd-debuginfo
Red Hat:enterprise_linux:8::crb
 before 0:5.50-3.el8
0:5.50-3.el8
bluez
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
5.35-0ubuntu25.36-0ubuntu15.37-0ubuntu55.37-0ubuntu5.15.37-0ubuntu5.3
Show 6 moreShow less
5.37-0ubuntu5.3+esm15.37-0ubuntu5.3+esm25.37-0ubuntu5.3+esm35.37-0ubuntu5.3+esm45.37-0ubuntu5.3+esm55.37-0ubuntu5.3+esm6
 None known
gnome-bluetooth
Ubuntu:18.04:LTS
 before 3.28.0-2ubuntu0.1, plus listed versions
3.26.1-13.26.1-23.26.1-33.27.90-13.28.0-13.28.0-2
3.28.0-2ubuntu0.1
bluez
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
5.46-0ubuntu35.46-0ubuntu45.48-0ubuntu35.48-0ubuntu3.15.48-0ubuntu3.2
Show 10 moreShow less
5.48-0ubuntu3.35.48-0ubuntu3.45.48-0ubuntu3.55.48-0ubuntu3.65.48-0ubuntu3.75.48-0ubuntu3.85.48-0ubuntu3.95.48-0ubuntu3.9+esm15.48-0ubuntu3.9+esm25.48-0ubuntu3.9+esm3
 None known

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-10910 is a medium vulnerability (CVSS 4.5) in Bluez, published July 24, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.46%, the 39th percentile. Fixed in bluez 5.54-1.

References

Show 17 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open