CVE-2019-9506: Apple iPhone OS

High severity, CVSS 8.1. EPSS: 2.7% chance of exploitation in the next 30 days.

The Bluetooth BR/EDR specification up to and including version 5.1 permits sufficiently low encryption key length and does not prevent an attacker from influencing the key length negotiation. This allows practical brute-force attacks (aka "KNOB") that can decrypt traffic and inject arbitrary ciphertext without the victim noticing.

Affected products

Apple iPhone OS: version 12.4 only
Apple Mac OS X: version 10.12.6 only; version 10.13.6 only; version 10.14.5 only
Apple tvOS: version 12.4 only
Apple watchOS: version 5.3 only
Canonical Ubuntu Linux: version 16.04 only; version 18.04 only; version 19.04 only
Debian Debian Linux: version 8.0 only
Google Android: affected versions not specified
Huawei Alp-AL00B Firmware: before 9.1.0.333\(c00e333r2p1t8\) (fixed in 9.1.0.333\(c00e333r2p1t8\))
Huawei Ares-AL00B Firmware: before 9.1.0.160\(c00e160r2p5t8\) (fixed in 9.1.0.160\(c00e160r2p5t8\))
Huawei Ares-AL10D Firmware: before 9.1.0.160\(c00e160r2p5t8\) (fixed in 9.1.0.160\(c00e160r2p5t8\))
Huawei Ares-TL00C Firmware: before 9.1.0.165\(c01e165r2p5t8\) (fixed in 9.1.0.165\(c01e165r2p5t8\))
Huawei Asoka-AL00AX Firmware: before 9.1.1.181\(c00e48r6p1\) (fixed in 9.1.1.181\(c00e48r6p1\))
Huawei Atomu-l33 Firmware: before 8.0.0.147\(c605custc605d1\) (fixed in 8.0.0.147\(c605custc605d1\))
Huawei Atomu-l41 Firmware: before 8.0.0.153\(c461custc461d1\) (fixed in 8.0.0.153\(c461custc461d1\))
Huawei Atomu-l42 Firmware: before 8.0.0.155\(c636custc636d1\) (fixed in 8.0.0.155\(c636custc636d1\))
Huawei Barca-AL00 Firmware: before 8.0.0.366\(c00\) (fixed in 8.0.0.366\(c00\))
Huawei Berkeley-AL20 Firmware: before 9.1.0.333\(c00e333r2p1t8\) (fixed in 9.1.0.333\(c00e333r2p1t8\))
Huawei Berkeley-l09 Firmware: before 9.1.0.332\(c432e5r1p13t8\) (fixed in 9.1.0.332\(c432e5r1p13t8\)); before 9.1.0.350\(c10e3r1p14t8\) (fixed in 9.1.0.350\(c10e3r1p14t8\)); before 9.1.0.350\(c636e4r1p13t8\) (fixed in 9.1.0.350\(c636e4r1p13t8\))
Huawei Berkeley-TL10 Firmware: before 9.1.0.333\(c01e333r1p1t8\) (fixed in 9.1.0.333\(c01e333r1p1t8\))
Huawei Bla-AL00B Firmware: before 9.1.0.329\(c786e320r2p1t8\) (fixed in 9.1.0.329\(c786e320r2p1t8\))
Huawei Bla-l29c Firmware: before 9.1.0.300\(c605e2r1p12t8\) (fixed in 9.1.0.300\(c605e2r1p12t8\)); before 9.1.0.306\(c185e2r1p13t8\) (fixed in 9.1.0.306\(c185e2r1p13t8\)); before 9.1.0.306\(c432e4r1p11t8\) (fixed in 9.1.0.306\(c432e4r1p11t8\)); before 9.1.0.306\(c636e2r1p13t8\) (fixed in 9.1.0.306\(c636e2r1p13t8\)); before 9.1.0.307\(c635e4r1p13t8\) (fixed in 9.1.0.307\(c635e4r1p13t8\))
Huawei Bla-TL00B Firmware: before 9.1.0.329\(c01e320r1p1t8\) (fixed in 9.1.0.329\(c01e320r1p1t8\))
Huawei Cairogo-l22 Firmware: before cairogo-l22c461b153 (fixed in cairogo-l22c461b153)
Huawei Charlotte-l29c Firmware: before 9.1.0.311\(c605e2r1p11t8\) (fixed in 9.1.0.311\(c605e2r1p11t8\)); before 9.1.0.325\(c185e4r1p11t8\) (fixed in 9.1.0.325\(c185e4r1p11t8\)); before 9.1.0.325\(c636e2r1p12t8\) (fixed in 9.1.0.325\(c636e2r1p12t8\)); before 9.1.0.328\(c432e5r1p9t8\) (fixed in 9.1.0.328\(c432e5r1p9t8\)); before 9.1.0.328\(c782e10r1p9t8\) (fixed in 9.1.0.328\(c782e10r1p9t8\))
Huawei Columbia-AL10B Firmware: before 9.1.0.333\(c00e333r1p1t8\) (fixed in 9.1.0.333\(c00e333r1p1t8\))
and 122 more

Published 2019-08-14. Last modified 2026-06-17.