Microchip BM83 Firmware vulnerabilities

5 CVEs affecting Microchip BM83 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-46403, published 2022-12-19.

More from Microchip.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2022-46403, published 2022-12-19. High severity, CVSS 8.6. EPSS: 0.9% chance of exploitation in the next 30 days. The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) mishandles reject messages.
• CVE-2022-46399, published 2022-12-19. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) is unresponsive with ConReqTimeoutZero.
• CVE-2022-46401, published 2022-12-19. Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days. The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) accepts PauseEncReqPlainText before pairing is complete.
• CVE-2022-46400, published 2022-12-19. Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days. The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) allows attackers to bypass passkey entry in legacy pairing.
• CVE-2022-46402, published 2022-12-19. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) accepts PairCon_rmSend with incorrect values.