PT-2025-29084 · Opensynergy · Bluesdk

Published 2025-07-07 · Updated 2025-09-17 · CVE-2024-45434

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: OpenSynergy BlueSDK (aka Blue SDK) versions through 6.x

Description: The vulnerability resides within the BlueSDK Bluetooth stack and is due to a use-after-free condition. This flaw occurs because of a lack of validation to confirm the existence of an object before operations are performed on it. An attacker can leverage this to achieve remote code execution within the context of the user account under which the Bluetooth process is running.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2025-09385

CVE-2024-45434

Affected Products

Bluesdk

References · 17

• 🔥 https://pcacybersecurity.com/resources/advisory/perfekt-blue · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-45434 · Security Note
• https://bdu.fstec.ru/vul/2025-09385 · Security Note
• https://osv.dev/vulnerability/CVE-2024-45434 · Vendor Advisory
• https://t.me/aptreports/20276 · Telegram Post
• https://twitter.com/_0b1d1/status/1943657432628199436 · Twitter Post
• https://twitter.com/SecAideInfo/status/1967532802414403743 · Twitter Post
• https://twitter.com/autumn_good_35/status/1943294204228317239 · Twitter Post
• https://t.me/purp_sec/888 · Telegram Post
• https://opensynergy.com · Note
• https://twitter.com/cracbot/status/1968268779034644762 · Twitter Post
• https://t.me/cveNotify/135324 · Telegram Post
• https://t.me/true_secator/7214 · Telegram Post
• https://twitter.com/CVEnew/status/1966536920441245920 · Twitter Post
• https://twitter.com/DataDecoder0/status/1945886668474454149 · Twitter Post