Security readout for executives and security teams
Plain-English summary
This flaw can make affected Bluetooth devices stop accepting new Bluetooth connections until someone restarts the device. It is a local, radio-range availability issue, not a data theft issue based on the provided sources. Business urgency depends on whether Bluetooth connectivity is operationally important for products using the Zhuhai Jieli AC6366C BT SDK through 0.9.1.
Executive priority
Prioritize if affected Bluetooth devices support customer-facing, safety-adjacent, or operational workflows. For general consumer peripherals, treat as a managed availability risk pending vendor firmware guidance.
Technical view
CVE-2021-34144 affects Bluetooth Classic handling in Zhuhai Jieli AC6366C BT SDK through 0.9.1. A truncated LMP_SCO_Link_Request packet received while no other Bluetooth connections are active can disable inquiry and page scan procedures, preventing new connections until manual power cycling restores connectivity.
Likely exposure
Exposure is likely limited to devices or firmware built with the Zhuhai Jieli AC6366C BT SDK through 0.9.1. The source bundle does not identify downstream product models, asset counts, or affected OEM firmware versions.
Exploitation context
The CVE states an attacker must be in Bluetooth radio range and use a crafted LMP packet. CISA KEV status is false, and the provided sources do not claim active exploitation in the wild.
Researcher notes
Evidence supports a Bluetooth Classic denial-of-service condition tied to a truncated LMP packet and idle connection state. No CVSS, CWE, patch version, affected downstream products, or active exploitation evidence is provided in the bundle.
Mitigation direction
- Inventory products using Zhuhai Jieli AC6366C BT SDK through 0.9.1.
- Check Jieli and OEM guidance for patched SDK or firmware versions.
- Request firmware status from suppliers for Bluetooth-dependent devices.
- Limit physical access near critical affected Bluetooth devices where practical.
- Document power-cycle recovery for operational teams.
Validation and detection
- Identify device firmware or SBOM references to AC6366C BT SDK.
- Confirm whether deployed firmware uses SDK version 0.9.1 or earlier.
- Review vendor advisories and release notes for this CVE.
- Test recovery procedures in a controlled lab, not production.
- Track affected assets where Bluetooth availability supports operations.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-34144 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/Jieli-Tech/fw-AC63_BT_SDKCVE reference · x_refsource_MISC
- https://launchstudio.bluetooth.com/ListingDetails/91371CVE reference · x_refsource_MISC
- https://dl.packetstormsecurity.net/papers/general/braktooth.pdfCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.