PT-2025-47184 · Espressif · Esp32+1

Published 2025-11-17 · Updated 2025-11-17 · CVE-2025-64342

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions ESF-IDF versions prior to 5.1.7 ESF-IDF versions prior to 5.2.6 ESF-IDF versions prior to 5.3.5 ESF-IDF versions prior to 5.4.3 ESF-IDF versions prior to 5.5.2

Description ESF-IDF, the Espressif Internet of Things (IOT) Development Framework, is affected by an issue where the ESP32, while in advertising mode, may cease advertising unexpectedly upon receiving a connection request with an invalid Access Address (AA) of 0x00000000 or 0xFFFFFFFF. This can lead to the controller incorrectly reporting a connection event to the host, potentially causing the application layer to falsely believe a successful connection has been established.

Recommendations Update to ESF-IDF version 5.1.7 or later. Update to ESF-IDF version 5.2.6 or later. Update to ESF-IDF version 5.3.5 or later. Update to ESF-IDF version 5.4.3 or later. Update to ESF-IDF version 5.5.2 or later.

Exploit

Fix

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

Related Identifiers

CVE-2025-64342

GHSA-8MG7-9QPG-P92V

Affected Products

Esf-Idf

Esp32

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64342.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-64342 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64342 · Security Note
• https://github.com/espressif/esp-idf/commit/75967b578563ea7876dc215251cbb6d64bc9d768 · Note
• https://github.com/espressif/esp-idf/commit/bf66761962579f73aea682d1154b9c99b9d3d7dc · Note
• https://github.com/espressif/esp-idf/commit/e3d70429566ece1ef593d36aa4ebd320e0c95925 · Note
• https://github.com/espressif/esp-idf/security/advisories/GHSA-8mg7-9qpg-p92v · Note
• https://github.com/espressif/esp-idf/commit/8ec541023684d33b498fa21c5b4724bce748aa7b · Note
• https://github.com/espressif/esp-idf/commit/3b95b50703cd3301a370cffaa1cc299b1941fe2a · Note
• https://github.com/espressif/esp-idf/commit/309f031dd6b04de30c926a256508c65b0df95dfa · Note
• https://twitter.com/CVEnew/status/1990477796401909843 · Twitter Post
• https://t.me/CVEtracker/37523 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1990495638031569063 · Twitter Post