PT-2026-22940 · Srk Powertech Pvt · Pebble Prism Ultra

Published 2026-03-04 · Updated 2026-03-09 · CVE-2025-69969

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SRK Powertech Pvt Ltd Pebble Prism Ultra version 2.9.2

Description A lack of authentication and authorization mechanisms in the Bluetooth Low Energy (BLE) communication protocol allows attackers to reverse engineer the protocol and execute arbitrary commands on the device without establishing a connection. This is exploitable over Bluetooth Low Energy (BLE) proximity, requiring no physical contact with the device. The issue includes cleartext data interception and unauthenticated firmware hijacking via Over-The-Air (OTA) services.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Cleartext Transmission of Sensitive Information

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-319

CWE-311

Related Identifiers

CVE-2025-69969

GHSA-CP6Q-87G8-MQ77

Affected Products

Pebble Prism Ultra

References · 9

• 🔥 https://github.com/mukundbhuva/BLEached-Security/security/advisories/GHSA-cp6q-87g8-mq77 · Exploit
• 🔥 https://github.com/mukundbhuva/BLEached-Security · Exploit
• https://osv.dev/vulnerability/CVE-2025-69969 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-69969 · Security Note
• https://twitter.com/infoflowcloud/status/2029273498120503740 · Twitter Post
• https://twitter.com/CveFindCom/status/2029250921645969830 · Twitter Post
• https://twitter.com/CVEnew/status/2029272855217688810 · Twitter Post
• https://twitter.com/TheHackerWire/status/2029247899922809100 · Twitter Post
• https://t.me/cveNotify/154835 · Telegram Post