Microchip BM77 Firmware vulnerabilities

2 CVEs affecting Microchip BM77 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-46401, published 2022-12-19.

More from Microchip.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2022-46399, published 2022-12-19. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) is unresponsive with ConReqTimeoutZero.
• CVE-2022-46401, published 2022-12-19. Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days. The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) accepts PauseEncReqPlainText before pairing is complete.