Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2021-40526 Details

Description

Incorrect calculation of buffer size vulnerability in Peleton TTR01 up to and including PTV55G allows a remote attacker to trigger a Denial of Service attack through the GymKit daemon process by exploiting a heap overflow in the network server handling the Apple GymKit communication. This can lead to an Apple MFI device not being able to authenticate with the Peleton Bike

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:5.3 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CNA: [email protected]CVSS-B:4.8 MEDIUMVector:CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://twitter.com/ROPsicle/status/1438216078103044107?s=20	CVE	Third Party Advisory
https://twitter.com/ROPsicle/status/1438216078103044107?s=20	[email protected]	Third Party Advisory

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-131	Incorrect Calculation of Buffer Size	[email protected]

Affected Products

Product	Versions
onepeloton ttr01 firmware	<= ptv55g
CPE cpe:2.3:o:onepeloton:ttr01_firmware:::::::: Remediation No remediation found in references.
onepeloton ttr01	All versions
CPE cpe:2.3:h:onepeloton:ttr01:-:::::::* Remediation No remediation found in references.

Change History

4 change records found show changes

Date	Action	Recorded By
Jun 17, 2026	CVE Modified	[email protected]
Nov 21, 2024	CVE Modified	CVE
May 14, 2024	CVE Modified	[email protected]
Oct 28, 2021	Initial Analysis	[email protected]