CVE-2019-19194

CVE-2019-19194 describes a critical vulnerability in Telink Semiconductor BLE SDK versions prior to November 2019, affecting TLSR8x5x, TLSR823x, and TLSR826x devices. This flaw allows an attacker within radio range to establish an encrypted session with a zero long-term key (LTK) by sending an out-of-order link-layer encryption request during Secure Connections pairing. The vulnerability has a CVSS score of 8.8 (HIGH), indicating high impact on confidentiality, integrity, and availability, with a low attack complexity and no user interaction required. While there is no evidence of active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion and media coverage, suggesting awareness and potential for future exploitation.