PatchTheCVECVE-2026-19292: Re-pairing with a legitimate device can use a lower security level than previous making brute-forcing the LTK
38
Routine
HIGH 8.8
CVE-2026-19292 is a high-severity flaw (CVSS 8.8) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Re-pairing with a legitimate device can use a lower security level than previous making brute-forcing the LTK easier. See V4 in the BLERP paper linked below.
Why this priority
- High severity
A fixed release or distro patch exists.
Risk facts
| CVSS score | 8.8 (High) |
| Attack vector | Adjacent network |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.4% (top 72%) |
| CISA exploited list | No |
| Weakness | CWE-305 |
| Published | 2026-08-13 |
| Last modified | 2026-10-23 |
Publisher (CNA): Silicon Labs
Timeline
- Published CVE record published
- Updated Record last modified
Exact fixes by distribution
Fedora 46 · wasmedge · FIXED · 0.18.1-1.fc46 · FEDORA-2026-4c27216e39 · source
sudo dnf upgrade --advisory=FEDORA-2026-4c27216e39
Public exploits and detection
Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.