Espressif ESP32 chips allow 29 hidden HCI commands, such as 0xFC02 (Write memory).
PoC: Bluetooth-Attacks-CVE-2025-27840
Bitcoin Cryptanalysis: CVE-2025-27840 Vulnerability in ESP32 Microcontrollers Puts Billions of IoT Devices at Risk via Wi-Fi & Bluetooth
[POC] GHSA-8gj2-2cvc-6xx7 — esp32-cve-2025-27840-power-trace-experiment
Firmware for getting a power trace of the behavior of the bluetooth module on the ESP32 when the ESP32 is sent the undocumented hci bluetooth commands (CVE-2025-27840). Uses ESP-IDF v5.0.8 and v5.0.9.
PoC: CVE-2025-27840-WIP
A Work-In-Progress for CVE-2025-27840
PoC: CVE-2025-27840
Expanded version of the code shown at RootedCON redone in python - CVE-2025-27840
CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L
Get alerted for CVEs like this
Register your stack and get notified within minutes when a matching CVE drops.
Start monitoring free