CVE-2025-10457
📋 TL;DR
This vulnerability allows attackers to spoof BLE connection responses to devices running vulnerable Zephyr RTOS versions. By sending unsolicited connection responses with matching identifiers, attackers can establish unauthorized BLE connections. This affects IoT devices, wearables, and embedded systems using Zephyr RTOS.
💻 Affected Systems
- Zephyr RTOS
📦 What is this software?
Zephyr by Zephyrproject
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise via unauthorized BLE connection leading to data exfiltration, device control, or firmware manipulation.
Likely Case
Unauthorized BLE connection establishment allowing data interception, device enumeration, or denial of service.
If Mitigated
Minimal impact with proper network segmentation and BLE security controls in place.
🎯 Exploit Status
Requires physical proximity or network access to BLE range. No authentication needed to send spoofed responses.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Zephyr v3.7.1 and later
Vendor Advisory: https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-xqj6-vh76-2vv8
Restart Required: Yes
Instructions:
1. Update Zephyr RTOS to v3.7.1 or later. 2. Rebuild firmware with updated Zephyr version. 3. Deploy updated firmware to affected devices.
🔧 Temporary Workarounds
Disable BLE functionality
allTemporarily disable Bluetooth Low Energy if not required for device operation.
CONFIG_BT=n in prj.conf
Implement BLE connection filtering
allAdd application-layer validation of expected connection responses.
🧯 If You Can't Patch
- Segment BLE devices on isolated networks
- Implement physical access controls to limit BLE range
🔍 How to Verify
Check if Vulnerable:
Check Zephyr version in build configuration or device firmware. Versions prior to v3.7.1 are vulnerable.Check Version:
grep -r "ZEPHYR_VERSION" build/zephyr/include/generated/version.hVerify Fix Applied:
Verify Zephyr version is v3.7.1 or later in build configuration and deployed firmware.📡 Detection & Monitoring
Log Indicators:
- Unexpected BLE connection establishments
- Multiple failed connection attempts from unknown devices
Network Indicators:
- Unusual BLE traffic patterns
- Connection attempts without prior discovery
SIEM Query:
BLE connection events where source device not in whitelist