PT-2025-10465 · Espressif · Espressif Esp32

Rjmunro · Publicado 2025-03-08 · Atualizado 2026-04-17 · CVE-2025-27840

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Média

Vetor base

AV:P/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Espressif ESP32 (affected versions not specified)

Description The Espressif ESP32 chip contains 29 hidden HCI commands, such as 0xFC02 (Write memory), which can be used for cyberattacks. These commands can be exploited to impersonate trusted devices, gain unauthorized access to data, pivot to other devices on the network, and potentially establish long-term persistence. The issue affects over a billion devices worldwide, including IoT devices, and highlights the need for better security audits.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Hidden Functionality

Enumeração de Fraquezas

CWE-912

Identificadores relacionados

BDU:2025-02470

CVE-2025-27840

Produtos afetados

Espressif Esp32

Referências · 132

• 🔥 https://github.com/demining/Bluetooth-Attacks-CVE-2025-27840 · Exploit
• 🔥 https://github.com/em0gi/CVE-2025-27840/blob/main/Enumerate.py · Exploit
• 🔥 https://github.com/em0gi/CVE-2025-27840 · Exploit
• 🔥 https://darkmentor.com/blog/esp32_non-backdoor · Exploit
• 🔥 https://bleepingcomputer.com/news/security/undocumented-backdoor-found-in-bluetooth-chip-used-by-a-billion-devices · Exploit
• 🔥 https://bleepingcomputer.com/news/security/undocumented-commands-found-in-bluetooth-chip-used-by-a-billion-devices · Exploit
• https://github.com/esphome/esphome/discussions/8382 · Nota
• https://github.com/TarlogicSecurity/Talks/blob/main/2025_RootedCon_BluetoothTools.pdf · Nota
• https://github.com/TarlogicSecurity/Talks · Nota
• https://t.me/cvenotify/114000 · Publicação no Telegram
• https://twitter.com/CryptosR_Us/status/1912950234696515998 · Publicação no Twitter
• https://twitter.com/kalomato_/status/1898659752990675240 · Publicação no Twitter
• https://twitter.com/Dinosn/status/1911607220137046522 · Publicação no Twitter
• https://twitter.com/paramdhagia/status/1898651800971903260 · Publicação no Twitter
• https://reddit.com/r/CVEWatch/comments/1k0pflo/top_10_trending_cves_16042025 · Publicação no Reddit