OpenSynergy BlueSDK Bluetooth Stack Incorrect Function Call Vulnerability Leading to Information Leak

A vulnerability has been identified in OpenSynergy BlueSDK versions through 6.x, within the BlueSDK Bluetooth stack. The issue arises from an incorrect variable being used as a function argument, which can lead to unexpected behavior or an information leak. This vulnerability can be exploited after pairing, but may also be available before pairing on some devices, depending on the implementation by the end developer.

Impact

Exploitation of this vulnerability can cause unexpected behavior in the application using the Bluetooth stack or lead to an information leak.

Remediation

OpenSynergy has released patches for this vulnerability, but not all OEMs have received the update yet.