{"id":"CVE-2026-97402","kind":"vulnerability","aliases":["CVE-2026-97402"],"related":[],"title":"Eclipse Kura: crafted BLE beacon packet halts gateway beacon scanning","description":"In Eclipse Kura versions 3.1.0 to 5.6.2, the iBeacon and Eddystone advertisement decoders wrongly parse the AD-structure length field of an over-the-air BLE advertising payload. Any unauthenticated attacker within BLE radio range can broadcast a two-byte advertising payload that drives the Kura beacon-scanner thread into a tight infinite loop, pinning a CPU core and permanently halting beacon ingestion until the gateway is restarted. To trigger the attack, the iBeacon/Eddystone scanner component should be installed and active. By default the components are not installed or enabled.","summary":"Eclipse Kura's iBeacon and Eddystone decoders misparse the length field of BLE advertisements, so a two-byte broadcast sends the beacon scanner into an infinite loop. An attacker within Bluetooth range can pin a CPU core and stop beacon ingestion until the gateway restarts.","severity":"low","cvss":2.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bluetooth-ble","eclipse-kura","infrastructure","iot-gateway"],"not_affected_if":["default-config","no-ble-scanner"],"how_to_check":"- Check whether the iBeacon/Eddystone scanner component is installed and enabled in the Kura gateway configuration (the sources say it is not installed or enabled by default).\n- Check the installed Kura version: affected versions are `3.1.0` through `5.6.2`.","fix":null,"status":"open","published_at":"2026-11-10T16:17:25+00:00","first_seen_at":"2026-11-10T16:22:35+00:00","triaged_at":"2026-11-10T16:23:46+00:00","updated_at":"2026-11-10T16:23:46+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-10T16:23:46Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Eclipse Kura: crafted BLE beacon packet halts gateway beacon scanning","impact":"low","summary":"Eclipse Kura's iBeacon and Eddystone decoders misparse the length field of BLE advertisements, so a two-byte broadcast sends the beacon scanner into an infinite loop. An attacker within Bluetooth range can pin a CPU core and stop beacon ingestion until the gateway restarts.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["eclipse-kura","iot-gateway","bluetooth-ble"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Beacon scanning halts and a CPU core stays pinned until restart","analyst_note":"Confirm the fixed version in the Eclipse Kura advisory linked as the vendor advisory; the sources here do not state one.","how_to_check":"- Check whether the iBeacon/Eddystone scanner component is installed and enabled in the Kura gateway configuration (the sources say it is not installed or enabled by default).\n- Check the installed Kura version: affected versions are `3.1.0` through `5.6.2`.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["default-config","no-ble-scanner"],"who_is_affected":"Only gateways running Eclipse Kura 3.1.0 to 5.6.2 with the iBeacon or Eddystone scanner component installed and enabled are exposed. The attack needs no account, but the attacker must be within BLE radio range of the gateway. Gateways without that component, or running a version outside the range, can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000779,"input_tokens":4692,"output_tokens":620,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-97402':13A,16A '3.1.0':77C '5.6.2':79C 'activ':157C 'ad':90C 'ad-structur':89C 'advertis':40B,84C,101C,116C 'air':99C 'attack':56B,105C,148C 'beacon':5A,9A,49B,67B,123C,138C 'beacon-scann':122C 'ble':4A,19B,39B,100C,107C 'bluetooth':18B,58B 'bluetooth-bl':17B 'broadcast':46B,111C 'byte':45B,115C 'compon':152C,161C 'core':64B,134C 'cpu':63B,133C 'craft':3A 'cve':11A,14A 'decod':33B,85C 'default':159C 'drive':119C 'eclips':1A,21B,27B,74C 'eclipse-kura':20B 'eddyston':32B,83C 'enabl':166C 'field':37B,93C 'gateway':8A,26B,71B,142C 'halt':7A,137C 'ibeacon':30B,81C 'ibeacon/eddystone':150C 'infinit':53B,129C 'infrastructur':23B 'ingest':68B,139C 'instal':155C,164C 'iot':25B 'iot-gateway':24B 'kura':2A,22B,28B,75C,121C 'length':36B,92C 'loop':54B,130C 'mispars':34B 'over-the-air':96C 'packet':6A 'pars':87C 'payload':102C,117C 'perman':136C 'pin':61B,131C 'radio':108C 'rang':59B,109C 'restart':72B,144C 'scan':10A 'scanner':50B,124C,151C 'send':47B 'stop':66B 'structur':91C 'thread':125C 'tight':128C 'trigger':146C 'two':44B,114C 'two-byt':43B,113C 'unauthent':104C 'version':76C 'within':57B,106C 'wrong':86C","nicknames":[],"mitigations":[],"who_affected":"Only gateways running Eclipse Kura 3.1.0 to 5.6.2 with the iBeacon or Eddystone scanner component installed and enabled are exposed. The attack needs no account, but the attacker must be within BLE radio range of the gateway. Gateways without that component, or running a version outside the range, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["bluetoothble","eclipsekura","infrastructure","iotgateway","low"],"campaign_type":null,"search_a":"'-2026':12A,15A '-97402':13A,16A 'beacon':5A,9A 'ble':4A 'craft':3A 'cve':11A,14A 'eclips':1A 'gateway':8A 'halt':7A 'kura':2A 'packet':6A 'scan':10A","search_b":"'advertis':40B 'attack':56B 'beacon':49B,67B 'ble':19B,39B 'bluetooth':18B,58B 'bluetooth-bl':17B 'broadcast':46B 'byte':45B 'core':64B 'cpu':63B 'decod':33B 'eclips':21B,27B 'eclipse-kura':20B 'eddyston':32B 'field':37B 'gateway':26B,71B 'ibeacon':30B 'infinit':53B 'infrastructur':23B 'ingest':68B 'iot':25B 'iot-gateway':24B 'kura':22B,28B 'length':36B 'loop':54B 'mispars':34B 'pin':61B 'rang':59B 'restart':72B 'scanner':50B 'send':47B 'stop':66B 'two':44B 'two-byt':43B 'within':57B","search_c":"'3.1.0':77C '5.6.2':79C 'activ':157C 'ad':90C 'ad-structur':89C 'advertis':84C,101C,116C 'air':99C 'attack':105C,148C 'beacon':123C,138C 'beacon-scann':122C 'ble':100C,107C 'broadcast':111C 'byte':115C 'compon':152C,161C 'core':134C 'cpu':133C 'decod':85C 'default':159C 'drive':119C 'eclips':74C 'eddyston':83C 'enabl':166C 'field':93C 'gateway':142C 'halt':137C 'ibeacon':81C 'ibeacon/eddystone':150C 'infinit':129C 'ingest':139C 'instal':155C,164C 'kura':75C,121C 'length':92C 'loop':130C 'over-the-air':96C 'pars':87C 'payload':102C,117C 'perman':136C 'pin':131C 'radio':108C 'rang':109C 'restart':144C 'scanner':124C,151C 'structur':91C 'thread':125C 'tight':128C 'trigger':146C 'two':114C 'two-byt':113C 'unauthent':104C 'version':76C 'within':106C 'wrong':86C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T16:17:25+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"emo@eclipse.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-97402","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97402","severity":null,"published_at":"2026-11-10T16:17:25+00:00","modified_at":"2026-11-10T16:17:25+00:00","first_seen_at":"2026-11-10T16:22:35+00:00","fetched_at":"2026-11-10T16:22:35+00:00","note":null}],"documents":[{"id":116147,"url":"https://github.com/eclipse-kura/kura/security/advisories/GHSA-x83q-g5h7-ffc5","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}