6.8
CVE-2025-27840
- EPSS 1.26%
- Veröffentlicht 08.03.2025 20:15:36
- Zuletzt bearbeitet 12.03.2025 14:58:54
- Quelle cve@mitre.org
- CVE-Watchlists
- Unerledigt
Espressif ESP32 chips allow 29 hidden HCI commands, such as 0xFC02 (Write memory).
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Espressif ≫ Esp32 Firmware Version-
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 1.26% | 0.657 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 6.8 | 0.5 | 5.8 |
CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
|
| cve@mitre.org | 6.8 | 0.3 | 6 |
CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L
|
CWE-912 Hidden Functionality
The product contains functionality that is not documented, not part of the specification, and not accessible through an interface or command sequence that is obvious to the product's users or administrators.
https://github.com/TarlogicSecurity/Talks/blob/main/2025_RootedCon_BluetoothTools.pdf
https://x.com/pascal_gujer/status/1898442439704158276
https://www.tarlogic.com/news/backdoor-esp32-chip-infect-ot-devices/
https://www.bleepingcomputer.com/news/security/undocumented-backdoor-found-in-bluetooth-chip-used-by-a-billion-devices/
https://reg.rootedcon.com/cfp/schedule/talk/5
https://flyingpenguin.com/?p=67838
https://github.com/em0gi/CVE-2025-27840
https://github.com/orgs/espruino/discussions/7699
https://www.bleepingcomputer.com/news/security/undocumented-commands-found-in-bluetooth-chip-used-by-a-billion-devices/
https://cheriot.org/auditing/backdoor/2025/03/09/no-esp32-style-backdoor.html
https://darkmentor.com/blog/esp32_non-backdoor/
https://github.com/esphome/esphome/discussions/8382
https://news.ycombinator.com/item?id=43301369
https://news.ycombinator.com/item?id=43308740
https://www.espressif.com/en/news/Response_ESP32_Bluetooth