PT-2025-50496 · Espressif · Esp32

Published 2025-12-10 · Updated 2026-04-15 · CVE-2025-65821

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ESP32 (affected versions not specified)

Description An enabled UART download mode on the ESP32 chip allows an attacker to extract sensitive data from the flash memory, including Wi-Fi network details stored in the NVS partition. This access also enables reflashing the device with potentially malicious firmware.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-1191

Related Identifiers

CVE-2025-65821

Affected Products

Esp32

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-65821 · Security Note
• https://osv.dev/vulnerability/CVE-2025-65821 · Vendor Advisory
• https://github.com/dead1nfluence/Meatmeet-Pro-Vulnerabilities/blob/main/Device/UART-Download-Mode-Enabled.md · Note
• https://twitter.com/VulmonFeeds/status/1998973878366859436 · Twitter Post
• https://t.me/cveNotify/149436 · Telegram Post
• https://gist.github.com/dead1nfluence/4dffc239b4a460f41a03345fd8e5feb5#file-uart-download-mode-enabled-md · Note
• https://reddit.com/r/IOT/comments/1slty6n/bluetooth_on_iot_devices · Reddit Post
• https://twitter.com/CVEnew/status/2000248672194641968 · Twitter Post