CVE-2025-67399
📋 TL;DR
This vulnerability allows a physically proximate attacker to extract sensitive information from the AIRTH SMART HOME AQI MONITOR via its exposed UART port on the BK7231N controller. Attackers can access bootloader data and potentially obtain credentials or device secrets. Only users of this specific smart home monitor with physical access to the device are affected.
💻 Affected Systems
- AIRTH SMART HOME AQI MONITOR
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers obtain device credentials, encryption keys, or firmware secrets, enabling further attacks on the smart home ecosystem or user privacy compromise.
Likely Case
Local attackers extract bootloader information and potentially device identifiers, but may not obtain highly sensitive operational data without additional vulnerabilities.
If Mitigated
With physical security controls preventing unauthorized access to device ports, the vulnerability has minimal impact.
🎯 Exploit Status
Exploitation requires physical access to the device and basic UART communication tools (serial adapter, terminal software). The GitHub repository contains detailed exploitation documentation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: http://airth.com (no specific advisory found)
Restart Required: No
Instructions:
No official patch available. Contact vendor for firmware updates that disable or secure UART access.
🔧 Temporary Workarounds
Physical UART Port Disable
allPhysically disable or obscure the UART port to prevent access
Device Physical Security
allPlace device in secure location where physical ports cannot be accessed
🧯 If You Can't Patch
- Implement strict physical access controls to prevent unauthorized personnel from accessing devices
- Consider replacing vulnerable devices with updated models if vendor releases fixed versions
🔍 How to Verify
Check if Vulnerable:
Connect to device's UART port using serial adapter (typically 3.3V, 115200 baud) and check if bootloader information is accessible without authentication.Check Version:
Check bootloader version via UART connection or device firmware settings if available.Verify Fix Applied:
Attempt UART connection after vendor patch - should require authentication or show no response.📡 Detection & Monitoring
Log Indicators:
- Physical tampering indicators, unexpected device resets
Network Indicators:
- None - this is physical access only
SIEM Query:
Not applicable for network-based detection