dbcve.org
Ac6901 FirmwareOperating system · Zh Jieli

CVE-2021-31611

MEDIUM · 5.7 CVSS v3.1 Published 2021-09-07
Mitigation only
No fix yet — a mitigation exists. There is no fixed release. A documented workaround reduces exposure in the meantime.
See remediation →
60/100
Remediation priority · Elevated
No privileges

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
The Bluetooth Classic implementation on Zhuhai Jieli AC690X and AC692X devices does not properly handle an out-of-order LMP Setup procedure that is followed by a malformed LMP packet, allowing attackers in radio range to deadlock a device via a crafted LMP packet. The user needs to manually reboot the device to restore communication.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · moderate confidence

The Bluetooth Classic LMP (Link Manager Protocol) implementation on Zhuhai Jieli AC690X and AC692X devices fails to properly handle an out-of-order LMP Setup procedure followed by a malformed LMP packet. An attacker within radio range can send this crafted sequence to deadlock the device, requiring manual reboot to restore functionality.

MitigationRemediation requires a firmware update from the vendor that implements proper LMP packet sequence validation and error handling. As a workaround, limit Bluetooth exposure and avoid pairing with untrusted devices in public areas.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
Ac6901 FirmwareOperating system
Affected:all versions
Ac6925 FirmwareOperating system
Affected:all versions
Ac6926 FirmwareOperating system
Affected:all versions
Ac6928 FirmwareOperating system
Affected:all versions
Ac6921 FirmwareOperating system
Affected:all versions

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify the Bluetooth chip vendor and model
    Examine the device hardware specifications, PCB markings, or Bluetooth controller firmware strings. Look for references to 'Zhuhai Jieli', 'Jieli', 'AC690X', or 'AC692X' in the device documentation or FCC ID filings.
    Affected if The device uses a Zhuhai Jieli AC6901, AC6921, AC6925, AC6926, or AC6928 Bluetooth chip.
  2. Determine the firmware version
    Access the device settings or firmware information page, typically found in the device info menu, about screen, or via manufacturer diagnostic tools. Query the Bluetooth stack for the firmware build number or version string.
    Affected if Any firmware version is present, as all versions of the listed chips are affected.
  3. Verify Bluetooth is enabled
    Check the device Bluetooth settings to confirm Bluetooth functionality is turned on. On Android, check Settings > Bluetooth; on iOS check Settings > Bluetooth; or use command-line tools like 'hciconfig' on Linux or 'netsh bluetooth' on Windows.
    Affected if Bluetooth is currently enabled on the device.
  4. Confirm discoverable or pairing mode
    Observe whether the device is in discoverable mode, advertising mode, or accepting pairing connections. This is typically indicated by a pulsing Bluetooth icon or status in the Bluetooth settings panel.
    Affected if The device is in discoverable, advertising, or pairing mode, making it reachable by an attacker within radio range.

A device is affected if it contains any of the Zhuhai Jieli AC6901/AC6921/AC6925/AC6926/AC6928 Bluetooth chips with Bluetooth enabled, as all firmware versions of these chips are vulnerable to the LMP deadlock attack.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

From vendor data
Mitigation available No clean upgrade yet — mitigate in the meantime
Mitigation

Remediation requires a firmware update from the vendor that implements proper LMP packet sequence validation and error handling. As a workaround, limit Bluetooth exposure and avoid pairing with untrusted devices in public areas.

Fix this in Ac6901 Firmware Scoped from the published advisory
  • Consultation4.0 h
  • Testing8.0 h
  • Review / QA4.0 h
16.0 hours of engineering $2,720
Get help mitigating

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $4,352.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2021-31611 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2021-31611 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data