CVE-2021-39673: Bluetooth Module in Android Platform Vulnerability

platform/packages/modules/Bluetooth Updated 02 Oct 2025

Summary

01/10/2022

Disclosed on

CVE-2021-39673

CVE

Yes i

Fix available

High

Severity

Not published

CVSS Score

CVE-2021-39673: In bta_dm_remove_device of bta_dm_act.cc, there is a possible way for a BT device to receive a long term trackable identifier due to a permissions bypass. Affects platform/packages/modules/Bluetooth versions >= 13:0, < 13:2022-10-01. Fixed in 13:2022-10-01. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

The Bluetooth module in the Android platform is responsible for managing Bluetooth connections and providing communication capabilities between devices. It allows users to connect their Android devices to various Bluetooth-enabled devices such as headphones, speakers, and smartwatches. This vulnerability affects the Bluetooth module in Android versions 13.0 and earlier.

Vulnerability Detail

The vulnerability (CVE-2021-39673) arises from the use of BD_ADDR in BR/EDR as the identity address of BLE, which makes the dual-stack trackable. In the bta_dm_remove_device function of bta_dm_act.cc, there is a permissions bypass that allows a Bluetooth device to receive a long-term trackable identifier. This can lead to remote information disclosure without requiring additional execution privileges. Exploitation of this vulnerability does not require user interaction.

How To Fix

Minimum fixed version

13:2022-10-01

This is the first release that contains the fix.

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Workaround

There is no known workaround for this vulnerability at the moment.

Conclusion

The Bluetooth module in the Android platform is vulnerable to a permissions bypass that allows a Bluetooth device to receive a long-term trackable identifier. This can result in remote information disclosure. It is recommended to update the Android platform to the latest version to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.

See every vulnerability recorded for platform/packages/modules/Bluetooth →