CVE-2021-40526

Incorrect calculation of buffer size vulnerability in Peleton TTR01 up to and including PTV55G allows a remote attacker to trigger a Denial of Service attack through the GymKit daemon process by exploiting a heap overflow in the network server handling the Apple GymKit communication. This can lead to an Apple MFI device not being able to authenticate with the Peleton Bike

CVSS v3 5.3 MEDIUM
CVSS v2.0 5.0 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
https://twitter.com/ROPsicle/status/1438216078103044107?s=20	Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:onepeloton:ttr01_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:onepeloton:ttr01:-:*:*:*:*:*:*:*

History

28 Oct 2021, 14:16

Type	Values Removed	Values Added
CWE		CWE-131
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : 5.0 v3 : 5.3
References	~~(CONFIRM) https://twitter.com/ROPsicle/status/1438216078103044107?s=20 -~~	(CONFIRM) https://twitter.com/ROPsicle/status/1438216078103044107?s=20 - Third Party Advisory
CPE		cpe:2.3:o:onepeloton:ttr01_firmware:::::::: cpe:2.3:h:onepeloton:ttr01:-:::::::*

25 Oct 2021, 11:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2021-10-25 11:15

Updated : 2024-02-04 22:08

NVD link : CVE-2021-40526

Mitre link : CVE-2021-40526

CVE.ORG link : CVE-2021-40526

JSON object : View

Products Affected

onepeloton

ttr01
ttr01_firmware

CWE

CWE-131

Incorrect Calculation of Buffer Size

{"id": "CVE-2021-40526", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 2.2}]}, "published": "2021-10-25T11:15:07.653", "references": [{"url": "https://twitter.com/ROPsicle/status/1438216078103044107?s=20", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-131"}]}], "descriptions": [{"lang": "en", "value": "Incorrect calculation of buffer size vulnerability in Peleton TTR01 up to and including PTV55G allows a remote attacker to trigger a Denial of Service attack through the GymKit daemon process by exploiting a heap overflow in the network server handling the Apple GymKit communication. This can lead to an Apple MFI device not being able to authenticate with the Peleton Bike"}, {"lang": "es", "value": "Una vulnerabilidad de c\u00e1lculo incorrecto del tama\u00f1o del b\u00fafer en Peleton TTR01 versiones hasta PTV55G incluy\u00e9ndola, permite a un atacante remoto desencadenar un ataque de denegaci\u00f3n de servicio mediante el proceso daemon de GymKit al explotar un desbordamiento de pila en el servidor de red manejando la comunicaci\u00f3n de Apple GymKit. Esto puede conllevar a que un dispositivo Apple MFI no pueda autenticarse con Peleton Bike"}], "lastModified": "2021-10-28T14:16:26.793", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:onepeloton:ttr01_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "03F84C5A-0ED6-4AD7-A70E-7551E368D37A", "versionEndIncluding": "ptv55g"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:onepeloton:ttr01:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "430B4497-30D4-493F-B5F4-8EE3DEF09954"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}