CVE-2023-40078 – This vulnerability allows a paired Bluetooth de... (How to Fix)

Q: What is the severity of CVE-2023-40078?

CVE-2023-40078 has a CVSS score of 9.8 (CRITICAL). This vulnerability allows a paired Bluetooth device to execute arbitrary code on an Android device without user interaction. It affects Android devices with Bluetooth enabled that are running vulnerable versions of the Bluetooth stack. The attacker needs to be within Bluetooth range of the target device.

📋 TL;DR

This vulnerability allows a paired Bluetooth device to execute arbitrary code on an Android device without user interaction. It affects Android devices with Bluetooth enabled that are running vulnerable versions of the Bluetooth stack. The attacker needs to be within Bluetooth range of the target device.

💻 Affected Systems

Products:

Android devices with Bluetooth support

Versions: Android versions prior to December 2023 security patch

Operating Systems: Android

Default Config Vulnerable: ⚠️ Yes

Notes: Requires Bluetooth to be enabled and device to be paired with attacker's device; affects both phones and tablets

📦 What is this software?

Android by Google

View all CVEs affecting Android →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Full device compromise allowing remote code execution, data theft, persistence, and lateral movement within the network.

🟠

Likely Case

Local privilege escalation leading to app data access, microphone/camera activation, or credential theft from the compromised device.

🟢

If Mitigated

Limited impact if Bluetooth is disabled or device is not paired with malicious devices; patched devices are fully protected.

🌐 Internet-Facing: LOW

🏢 Internal Only: HIGH

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires attacker to have a paired Bluetooth device; no user interaction needed once paired

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: December 2023 Android Security Patch Level or later

Vendor Advisory: https://source.android.com/security/bulletin/2023-12-01

Restart Required: Yes

Instructions:

1. Check for system updates in Settings > System > System update. 2. Install December 2023 security patch or later. 3. Restart device after installation.

🔧 Temporary Workarounds

Disable Bluetooth

android

Turn off Bluetooth when not in use to prevent pairing with malicious devices

adb shell settings put global bluetooth_on 0
Settings > Connected devices > Connection preferences > Bluetooth > Toggle off

Remove unused pairings

android

Remove Bluetooth pairings with unknown or untrusted devices

Settings > Connected devices > Previously connected devices > Tap device > Forget

🧯 If You Can't Patch

Disable Bluetooth completely and use wired alternatives
Implement network segmentation to isolate vulnerable devices from critical systems

🔍 How to Verify

Check if Vulnerable:

Check Android security patch level in Settings > About phone > Android version > Security patch level

Check Version:

adb shell getprop ro.build.version.security_patch

Verify Fix Applied:

Verify security patch level shows December 2023 or later date

📡 Detection & Monitoring

Log Indicators:

Unusual Bluetooth connection attempts from unknown MAC addresses
Bluetooth stack crashes in system logs

Network Indicators:

Suspicious Bluetooth traffic patterns
Multiple failed pairing attempts

SIEM Query:

source="android_system" "Bluetooth" "stack" "overflow" OR "crash"

📊 Metadata

CVE ID: CVE-2023-40078

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-787

Published: December 4, 2023

Last Updated: November 21, 2024

🔗 References

https://android.googlesource.com/platform/packages/modules/Bluetooth/+/6cdf985a664476659b84d8c74698cb3dfa28f82b Mailing List,Patch
https://source.android.com/security/bulletin/2023-12-01 Patch,Third Party Advisory
https://android.googlesource.com/platform/packages/modules/Bluetooth/+/6cdf985a664476659b84d8c74698cb3dfa28f82b Mailing List,Patch
https://source.android.com/security/bulletin/2023-12-01 Patch,Third Party Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2023-40078, you might also want to check these: