Description

Re-pairing with a legitimate device can use a lower security level than previous making brute-forcing the LTK easier. See V4 in the BLERP paper linked below.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-13T15:19:37.737Z",
  "pubdate": "2026-08-13T15:19:37.737Z",
  "executiveSummary": "This vulnerability involves a security downgrade flaw occurring during the re-pairing process between a host and a legitimate device. Specifically, the re-pairing procedure permits the establishment of a lower security level than that utilized during previous associations, thereby significantly reducing the cryptographic complexity and entropy required to derive or crack session keys. The impact of this security lapse includes weakened session encryption and an increased susceptibility to offline brute-force attacks against the Long Term Key (LTK). Affected systems comprise Bluetooth protocol implementations and connected peripherals that fail to enforce strict cryptographic downgrade prevention mechanisms during re-establishment phases. The risk implications are severe, as an adversary capable of observing the pairing exchange can leverage the reduced security parameters to compromise encrypted communications. Attacker capabilities require proximity to intercept the wireless pairing handshake and sufficient computational resources to execute brute-force routines against the degraded key space. Exploitation requirements mandate that the attacker can force or observe a re-pairing event between previously authenticated devices, exploiting the protocol's state machine handling.",
  "technicalDetails": "The root cause of this vulnerability lies in the state transition and security negotiation logic of the Bluetooth pairing protocol, as identified in research referenced via the BLERP paper. When a previously paired legitimate device initiates a re-pairing or connection update sequence, the protocol implementation fails to mandate the enforcement of historical security thresholds or the highest previously negotiated security parameters. Instead, the negotiation phase permits a transition to a lower security mode, which directly impacts the derivation and entropy of the Long Term Key (LTK). The exploitation method relies on an adversary intercepting or manipulating the pairing protocol messages to force a downgrade in the authentication and encryption parameters. During the attack flow, the malicious actor first observes or induces a re-pairing condition between the legitimate device and the target host. Because the protocol allows a reduced security level, the cryptographic mechanisms generating the LTK utilize weaker parameters or reduced key spaces. Once the handshake is captured, the attacker applies offline brute-forcing techniques to recover the LTK. The vulnerable component is the Bluetooth key establishment and re-pairing state machine, which lacks mandatory downgrade protection and session continuity checks for security attributes. Affected versions include any Bluetooth implementations adhering to specifications that permit security level reductions during device re-association. Authentication and privilege requirements vary based on the specific scenario, but often no prior authentication is required by the attacker if they can spoof or force the re-pairing handshake over the wireless medium. The network exposure is limited to the physical Bluetooth radio range. The payload behavior involves capturing the pairing exchange containing the cryptographically weakened parameters. The post-exploitation impact includes the successful recovery of the LTK, allowing the adversary to decrypt historical or active traffic, decrypt sensitive data payloads, and perform unauthorized man-in-the-middle attacks against the paired devices."
}