Yes, i am reading the title which says 'Bluetooth keystroke-injection' which is concerning on one level, but in fact the article talks about authenticating a device without user interaction which seems way more serious to me.
however, it also mentions
> stay tuned for Part 2: More Vulnerabilities
That is only part of the CVSS scoring system. Not only do you need near-physical access (i.e. not open to the internet, already drops the rating significantly), it requires the victim to interact with a suspicious prompt, which basically drops it to the level of a phishing email (i.e. not CVSS 8.8).
This is an automatic bluetooth pairing attack. With the right equipment (which can be as simple as a Pringles can and an antenna aimed through a window) you can execute this attack from a hundred meters away. That's not physical access.
People are silly about security. Has your social media not been flooded with oldsters circulating that copypasta about how iOS contact sharing is going to let thieves "STEAL YOUR INFO!!1?!111"?
They’re not talking about this. They’re talking about the NameDrop feature added in iOS 17. The one with multiple confirmation steps, while the facebook memes talk like hackers can steal your info from long range with no intervention.
A small detail, though, the target device has to accept the connection. Once someone lets you in his house, you can steal his silver, yes.