CVE-2026-0101 – BLE Address Spoofing via Weak Resolvable Private Address

Program Code (Python using bleak simulation)

# ble_peripheral_sim.py - Simulated BLE peripheral with weak RPA verification
import asyncio, random, hashlib
from bleak import BleakServer, BleakScanner
# (Simplified - we'll use a basic socket to simulate BLE bonding)

# Store bonded IRK (Identity Resolving Key)
irk = b'\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10'
def resolve_rpa(rpa, irk):
    # This is a stub: real resolution uses AES-128; vulnerability: attacker can brute-force or replay
    # Assume the peripheral accepts any RPA that decrypts to a known hash without replay protection.
    return True  # always accept for demo

# Simulating the peripheral: wait for connection, check RPA, if resolved, trust.
print("Peripheral running, accepting any RPA...")

CVE-2026-0101 – BLE Spoofing via Replayed Resolvable Private Address

Overview

A Bluetooth Low Energy peripheral using Resolvable Private Addresses (RPA) fails to implement a replay cache. An attacker who observes a valid RPA can disconnect the bonded device and reconnect using the same RPA, impersonating the trusted device.

Vulnerability Details

• Type: Authentication Bypass / Replay Attack
• Impact: Unauthorized access, data theft from BLE peripherals (medical devices, locks).
• Root Cause: The peripheral does not track recently used RPAs or enforce a limited lifetime, allowing replay of a captured address within the same privacy interval.

Exploit Demonstration

Run the simulation:

python ble_peripheral_sim.py
# In another terminal:
python exploit_ble_spoof.py

The exploit captures the advertised RPA and would reconnect as the trusted device.