CVE-2025-69969

Katalog CVE

CVSS 9.6 · Critical EPSS 0,48%

Kerentanan Missing Encryption of Sensitive Data pada pebblepower pebble prism ultra firmware. Skor CVSS 3.1 9.6 (Critical) menurut CISA ADP.

Deskripsi (NVD)

A lack of authentication and authorization mechanisms in the Bluetooth Low Energy (BLE) communication protocol of SRK Powertech Pvt Ltd Pebble Prism Ultra v2.9.2 allows attackers to reverse engineer the protocol and execute arbitrary commands on the device without establishing a connection. This is exploitable over Bluetooth Low Energy (BLE) proximity (Adjacent), requiring no physical contact with the device. Furthermore, the vulnerability is not limited to arbitrary commands but includes cleartext data interception and unauthenticated firmware hijacking via OTA services.

Rincian

Terbit di NVD

4 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.6 (Critical), sumber CISA ADP
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-311: Missing Encryption of Sensitive Data
CWE-319: Cleartext Transmission of Sensitive Information

EPSS (30 hari)

0,48% peluang dieksploitasi; lebih tinggi dari 39,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/mukundbhuva/BLEached-Security exploit · advisory pihak ketiga
• https://github.com/mukundbhuva/BLEached-Security/security/advisories/GHSA-cp6q-87g8-mq77 exploit · advisory pihak ketiga