Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound in the handling of Bluetooth Low Energy BLE fixed channels, such as SMP or ATT. An attacker can cause the target device to send disconnection requests for fixed channels, which is not permitted by the...

Improperly Implemented Security Check for Standard

Overview Affected versions of this package are vulnerable to Improperly Implemented Security Check for Standard in the leconnrsp process. An attacker can cause a denial of service by sending an out-of-context Bluetooth Low Energy connection response when no connection request was initiated...

CVE-2025-10456

CVE-2025-10456 concerns BLE fixed-channel handling (SMP/ATT) in Zephyr RTOS. The root issue: a device may be tricked into sending a disconnection request for a fixed channel, which is disallowed by the Bluetooth spec, triggering undefined behavior such as assertion failures, crashes, or memory co...

CVE-2025-10456 Bluetooth: Semi-Arbitrary ability to make the BLE Target send disconnection requests

A vulnerability was identified in the handling of Bluetooth Low Energy BLE fixed channels such as SMP or ATT. Specifically, an attacker could exploit a flaw that causes the BLE target i.e., the device under attack to attempt to disconnect a fixed channel, which is not allowed per the Bluetooth...

CVE-2025-10456 Bluetooth: Semi-Arbitrary ability to make the BLE Target send disconnection requests

A vulnerability was identified in the handling of Bluetooth Low Energy BLE fixed channels such as SMP or ATT. Specifically, an attacker could exploit a flaw that causes the BLE target i.e., the device under attack to attempt to disconnect a fixed channel, which is not allowed per the Bluetooth...

CVE-2025-10456 Bluetooth: Semi-Arbitrary ability to make the BLE Target send disconnection requests

A vulnerability was identified in the handling of Bluetooth Low Energy BLE fixed channels such as SMP or ATT. Specifically, an attacker could exploit a flaw that causes the BLE target i.e., the device under attack to attempt to disconnect a fixed channel, which is not allowed per the Bluetooth...

CVE-2025-10457 Bluetooth: Out-Of-Context le_conn_rsp Handling

The function responsible for handling BLE connection responses does not verify whether a response is expected—that is, whether the device has initiated a connection request. Instead, it relies solely on identifier matching...

CVE-2025-10457 Bluetooth: Out-Of-Context le_conn_rsp Handling

The function responsible for handling BLE connection responses does not verify whether a response is expected—that is, whether the device has initiated a connection request. Instead, it relies solely on identifier matching...

PT-2025-38511

Name of the Vulnerable Software and Affected Versions affected versions not specified Description The function responsible for handling BLE Bluetooth Low Energy connection responses does not verify whether a response is expected, relying solely on identifier matching. This means the device does n...

Zephyr 安全漏洞

Zephyr is an extensible real-time operating system RTOS open-sourced by Zephyr. A security vulnerability exists in Zephyr that stems from a flaw in the handling of the Bluetooth Low Energy Fixed Channel, which could lead to undefined behavior, including assertion failure, crashes, or memory...

PT-2025-38514

Name of the Vulnerable Software and Affected Versions Bluetooth Low Energy BLE affected versions not specified Description A flaw exists in the handling of Bluetooth Low Energy BLE fixed channels, such as SMP or ATT. An attacker can exploit this issue, causing the BLE target device to attempt to...

Zephyr 安全漏洞

Zephyr is an extensible real-time operating system RTOS open-sourced by Zephyr. A security vulnerability exists in Zephyr that stems from a BLE connection response handler function that does not validate whether a response is expected and relies only on identifier matching...

CVE-2025-7355

Authorization Bypass Through User-Controlled Key vulnerability in Beefull Energy Technologies Beefull App allows Exploitation of Trusted Identifiers. This issue affects Beefull App: before 24.07.2025...

CVE-2025-7355 IDOR in Beefull Energy Technologies' Beefull App

Authorization Bypass Through User-Controlled Key vulnerability in Beefull Energy Technologies Beefull App allows Exploitation of Trusted Identifiers. This issue affects Beefull App: before 24.07.2025...

CVE-2025-7355

CVE-2025-7355 affects Beefull App (Beefull Energy Technologies) with an authorization bypass caused by exploitation of a user-controlled key. Affected versions are prior to 24.07.2025. The vulnerability enables bypass of trusted identifiers, as described across multiple feeds (Red Hat, NVD, CVE l...

CVE-2025-7355

Authorization Bypass Through User-Controlled Key vulnerability in Beefull Energy Technologies Beefull App allows Exploitation of Trusted Identifiers. This issue affects Beefull App: before 24.07.2025...

CVE-2025-7355 IDOR in Beefull Energy Technologies' Beefull App

Authorization Bypass Through User-Controlled Key vulnerability in Beefull Energy Technologies Beefull App allows Exploitation of Trusted Identifiers. This issue affects Beefull App: before 24.07.2025...

CISA Releases Eight Industrial Control Systems Advisories

CISA released eight Industrial Control Systems ICS advisories on September 16, 2025. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-259-01 Schneider Electric Altivar Products, ATVdPAC Module, ILC992 InterLink...

Hitachi Energy RTU500 series

RISK EVALUATION Successful exploitation of these vulnerabilities could cause a Denial-of-Service condition in RTU500 devices. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as: Minimize network exposure...

Advisory ROSA-SA-2025-3007

software: qt5-qtconnectivity 5.15.10 OS: ROSA-CHROME unaffected versions = qt5-qtconnectivity-5.15.15-3 affected versions qt5-qtconnectivity-5.15.15-3 CVE-ID: CVE-2025-23050 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC.: In the Qt Bluetooth module QLowEnergyController on Linux when using the Bluetooth...