CVE-2025-63895
📋 TL;DR
A vulnerability in the Bluetooth firmware of JXL 9 Inch Car Android Double Din Player allows attackers to cause a Denial of Service (DoS) by sending a specially crafted Link Manager Protocol (LMP) packet. This affects users of the JXL car infotainment system running Android v12.0, potentially rendering Bluetooth functionality unusable until the device is rebooted.
💻 Affected Systems
- JXL 9 Inch Car Android Double Din Player
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete disruption of Bluetooth functionality requiring physical access to reboot the device, potentially affecting hands-free calling, audio streaming, and other Bluetooth-dependent features while driving.
Likely Case
Temporary Bluetooth service disruption requiring device reboot, affecting infotainment system usability until reset.
If Mitigated
Minimal impact if Bluetooth is disabled or device is not in range of attackers.
🎯 Exploit Status
Exploit requires Bluetooth proximity and knowledge of the vulnerability; proof-of-concept code is publicly available on GitHub.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: http://jxl.com
Restart Required: No
Instructions:
No official patch available. Monitor vendor website for firmware updates.
🔧 Temporary Workarounds
Disable Bluetooth
allTurn off Bluetooth functionality to prevent exploitation.
Navigate to Settings > Bluetooth > Turn Off
Limit Bluetooth Visibility
allSet Bluetooth to non-discoverable mode when not pairing devices.
Navigate to Settings > Bluetooth > Visibility > Hidden/Non-discoverable
🧯 If You Can't Patch
- Physically power cycle the device if Bluetooth becomes unresponsive
- Avoid using Bluetooth in high-risk areas (public parking, crowded areas)
🔍 How to Verify
Check if Vulnerable:
Check device model and Android version in Settings > About Device. If model is JXL 9 Inch Car Android Double Din Player running Android 12.0, device is vulnerable.Check Version:
Settings > About Device > Android VersionVerify Fix Applied:
No fix available to verify. Monitor vendor for firmware updates.📡 Detection & Monitoring
Log Indicators:
- Bluetooth service crashes
- LMP protocol errors in Bluetooth logs
- Unexpected Bluetooth disconnections
Network Indicators:
- Unusual Bluetooth packet patterns from nearby devices
- Multiple LMP packets from single source
SIEM Query:
Not applicable - local Bluetooth attack without network logging