CVE-2019-9506: Blutooth BR/EDR specification does not specify sufficient encryption key length and allows an attacker to influence key length negotiation

Security readout for executives and security teams

CVE-2019-9506, known as KNOB, is a Bluetooth BR/EDR weakness where devices can be pushed into using very short encryption keys. A nearby attacker could potentially decrypt Bluetooth traffic or alter encrypted data without obvious user warning. The issue is important for organizations with managed laptops, phones, IoT, peripherals, or operational devices using classic Bluetooth. Exposure is likely wherever Bluetooth BR/EDR is enabled on devices whose Bluetooth stack, operating system, firmware, or kernel lacked vendor fixes. The bundle cites Bluetooth, Apple, Huawei, Ubuntu, Debian, Red Hat, and SUSE advisories, suggesting broad ecosystem relevance rather than one isolated product. Treat this as a high-priority hygiene and asset-management issue, especially for mobile and field environments. It is not internet-wormable from the provided evidence, but nearby attackers could compromise Bluetooth confidentiality and integrity on unpatched devices. Mitigation focus: Apply relevant vendor OS, kernel, firmware, and Bluetooth stack updates.; Check Bluetooth SIG and device vendor guidance for required key length enforcement.; Disable Bluetooth BR/EDR where business use is unnecessary..

Prepared

May 24, 2026, 01:29 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.