CVE-2021-37577

CVE-2021-37577 is a medium-severity vulnerability affecting Bluetooth Core Specifications 2.1 through 5.3, specifically impacting LE and BR/EDR Secure Connections pairing and Secure Simple Pairing using the Passkey entry protocol. An unauthenticated man-in-the-middle attacker can exploit this by reflecting a crafted public key and authentication evidence to identify the Passkey, potentially completing authenticated pairing with the responding device. The CVSS score is 6.8 (Medium), indicating a local attack vector with low complexity, requiring user interaction, and leading to high confidentiality and integrity impacts. There is no evidence of active exploitation, public exploit code, or significant community discussion, and it is not listed in CISA's KEV catalog.