Samsung Galaxy Buds Bluetooth Pairing Bypass Vulnerability CVE-2024-58101

Critical Vulnerability Information CVE ID CVE-2024-58101 CVSS Score CVSS v4.0 Score: 8.7 / High Vulnerability Description Devices: Samsung Galaxy Buds and Galaxy Buds 2 Issue: These devices enable Bluetooth pairing mode by default, allowing pairing without user input or interaction, and there is no way to disable this mode. Impact Device Control: Enables pairing and full control of the device without user consent or notification. Audio Playback and Recording: May lead to unauthorized audio playback takeover or microphone recording without user consent. Recommended Actions Current Status: No known fix is available. Timeline 2024/03/15: Initial report submitted via Samsung Mobile Security platform. 2024/03/21: Samsung requested separate tickets for each finding; the report was marked as "working as intended". 2024/03/22: Three separate reports were created for the most critical issues. 2024/03/29: Samsung suggested closing the ticket for BSAM-PA-01, marked as "working as intended", and provided rebuttal reasons. 2024/06/27: Request to keep the BSAM-PA-01 report open due to its security impact; CVE assignment requested. 2024/06/27: BSAM-PA-02 report marked as "no security impact" and outside the bounty program scope. 2024/06/27: BSAM-PA-05 report also marked as "no security impact" and outside the bounty program scope. 2024/06/27: BSAM-PA-01 marked as "low severity", but considered more severe than "low" due to potential security implications. 2024/06/24: CVE request denied; only medium or higher impact vulnerabilities are assigned CVEs. 2024/11/05: Samsung notified that BSAM-PA-01 report was awarded a bounty. 2025/01/27: Bounty payment completed. 2025/02/10: Request for CVE assignment submitted to MITRE. 2025/03/12: CVE-2024-58101 assigned. 2025/03/20: Public advisory released.

Goal Reached Thanks to every supporter — we hit 100%!

Samsung Galaxy Buds Bluetooth Pairing Bypass Vulnerability CVE-2024-58101