CVE-2025-15474
📋 TL;DR
This vulnerability allows an unauthenticated attacker within Bluetooth Low Energy (BLE) range to cause a denial of service on AuntyFey Smart Combination Locks by flooding connection requests. The attack interrupts legitimate keypad authentication and forces repeated lockouts, preventing authorized users from unlocking the device. Only users of affected AuntyFey smart locks are impacted.
💻 Affected Systems
- AuntyFey Smart Combination Lock
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Physical security compromise where legitimate users cannot access secured areas due to sustained lockout, potentially requiring physical destruction of the lock or alternative entry methods.
Likely Case
Temporary denial of service preventing legitimate users from unlocking the device until the BLE connection flood stops, causing inconvenience and potential minor security delays.
If Mitigated
Minimal impact if device is physically secured from nearby attackers or if firmware is patched to implement connection rate limiting.
🎯 Exploit Status
Public proof-of-concept code exists on GitHub. Attack requires only BLE-capable device and knowledge of the lock's BLE address. No authentication or special tools needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Check manufacturer website for firmware updates. If update becomes available, follow manufacturer's instructions to update lock firmware via their mobile app.
🔧 Temporary Workarounds
Physical isolation
allPlace lock in location with limited physical access to reduce attacker proximity
Temporary BLE disable
allIf supported, temporarily disable BLE functionality via manufacturer app
🧯 If You Can't Patch
- Monitor for unusual BLE activity patterns using BLE scanning tools
- Implement physical security measures to limit proximity access to the lock
🔍 How to Verify
Check if Vulnerable:
Check firmware version in manufacturer's mobile app. If version date is 2025-12-24 or earlier, device is vulnerable.Check Version:
Use manufacturer's mobile app to check firmware version under device settings.Verify Fix Applied:
After any firmware update, verify version in manufacturer app shows date later than 2025-12-24.📡 Detection & Monitoring
Log Indicators:
- Repeated BLE connection attempts in device logs
- Multiple failed authentication attempts
- Frequent lockout state entries
Network Indicators:
- Unusual BLE connection patterns from unknown MAC addresses
- High frequency of BLE connection requests
SIEM Query:
Not applicable - this is a physical device vulnerability not typically monitored by enterprise SIEM systems.