Security readout for executives and security teams
Plain-English summary
CVE-2019-12797 describes a clone ELM327 Bluetooth OBD-II vehicle dongle with a hardcoded pairing PIN. If such a dongle is installed and reachable over Bluetooth, an attacker could pair and send arbitrary commands onto the vehicle OBD-II bus.
Executive priority
Treat this as a targeted fleet and asset-management issue, not a broad enterprise software emergency. Prioritize vehicles where Bluetooth OBD-II dongles remain installed, especially operational, customer-facing, or safety-sensitive vehicles.
Technical view
The reported issue is hardcoded Bluetooth authentication in a clone ELM327 OBD2 adapter. The CVE states this can lead to arbitrary commands on a vehicle OBD-II bus. The public record does not identify a vendor, version range, CVSS score, CWE, patch, or complete affected-product list.
Likely exposure
Exposure is limited to vehicles using the affected clone-style ELM327 Bluetooth OBD-II device. The CVE data does not provide vendor or version identifiers, so organizations must validate by inventory and device inspection rather than CPE matching.
Exploitation context
The CVE is not listed as KEV, and the provided sources do not state active exploitation. Practical misuse appears to require Bluetooth proximity, the dongle being installed and powered, and successful pairing using the hardcoded PIN.
Researcher notes
The public CVE record is sparse: no CVSS, no CWE, no named vendor, no versions, and no patch details. Analysis should stay anchored to the clone ELM327 Bluetooth OBD-II device behavior described in the CVE and referenced KTH material.
Mitigation direction
- Remove untrusted Bluetooth OBD-II dongles when not actively needed.
- Inventory vehicle diagnostic adapters and identify clone ELM327 devices.
- Replace clone or undocumented adapters with vendor-supported devices.
- Check vendor or supplier guidance for firmware, configuration, or replacement options.
- Restrict physical access to vehicles using Bluetooth OBD-II adapters.
Validation and detection
- Confirm whether any vehicles use ELM327 Bluetooth OBD-II adapters.
- Record adapter markings, supplier, firmware claims, and pairing behavior.
- Check whether pairing relies on a fixed or default PIN.
- Verify whether the adapter remains powered while the vehicle is unattended.
- Review available vendor documentation for security controls or updates.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2019-12797 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://www.kth.se/polopoly_fs/1.914060.1561621279%21/Ludvig%20and%20Daniel_final_dongles.pdfCVE reference · x_refsource_MISC
- https://www.kth.se/polopoly_fs/1.917488.1564430206%21/elm327.pdfCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.