CVSS 3.1
Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)
Атакува се
Време до експлоатация
Атакува се по мрежата, без особени условия, без вход и без действие от потребителя.
- Експлоатация: няма данни за експлоатация
- Атаката може да се автоматизира
Описание
Оригинално описание
Bluehood monitors local bluetooth activity. Prior to version 0.7.1, when auth_enabled is set in Bluehood, only the HTML page handlers enforced session validation. The /api/* handlers (settings, devices, groups, per-device endpoints including /api/device/{mac}/notes) called no auth check at all. A network attacker reachable on the dashboard port could read Bluetooth tracking data and modify application state — including the heartbeat URL, prune retention, device groups, and per-device notes — without a session cookie. This issue has been patched in version 0.7.1.
Засегнати продукти
- dannymcc bluehood: < 0.7.1
Вид слабост
История
- 28 септември 2026 Публикувано
Първоизточници
- https://www.cve.org/CVERecord?id=CVE-2026-49994
- https://nvd.nist.gov/vuln/detail/CVE-2026-49994
- https://github.com/dannymcc/bluehood/security/advisories/GHSA-qj2j-wcg3-74jw
- https://github.com/dannymcc/bluehood/commit/401479938c0deb1f6f6847d442f98a2d03efca68
- https://github.com/dannymcc/bluehood/releases/tag/v0.7.1