CVE Feed

    Dashboard / CVE / CVE-2025-27840

    CVE-2025-27840

    Espressif ESP32 chips allow 29 hidden HCI commands, such as 0xFC02 (Write memory).

    Published:Mar 8, 2025
    Last Modified:May 12, 2025
    EPS:Mar 8, 2025
    EPSS Score:0.00196
    CVSS Score:6.8

    Affected Products

    Vendor
    Espressif
    Product
    Esp32
    Vendor
    Espressif
    Product
    Esp32 Firmware

    Exploits

    https://darkmentor.com/blog/esp32_non-backdoor/https://www.bleepingcomputer.com/news/security/undocumented-backdoor-found-in-bluetooth-chip-used-by-a-billion-devices/https://www.bleepingcomputer.com/news/security/undocumented-commands-found-in-bluetooth-chip-used-by-a-billion-devices/https://github.com/demining/Bluetooth-Attacks-CVE-2025-27840https://github.com/em0gi/CVE-2025-27840https://github.com/JasonW88/esp32-cve-2025-27840-power-trace-experimenthttps://github.com/ladyg00se/CVE-2025-27840-WIPhttps://github.com/v3ilsm1th/CVE-2025-27840-WIP

    Common Weakness Enumeration

    CWE-912 Hidden Functionality

    Related CVEs

    CVE-2026-41429 (CVSS 8.8) — arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontr…
    CVE-2025-68473 (CVSS 0) — ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.1, 5.4.3, 5.3.4, 5.2.…
    CVE-2025-65822 (CVSS 6.8) — The ESP32 system on a chip (SoC) that powers the Meatmeet Pro was found to have JTAG enabled. By leaving JTAG …
    CVE-2025-65829 (CVSS 6.8) — The ESP32 system on a chip (SoC) that powers the Meatmeet basestation device was found to lack Secure Boot. Th…
    CVE-2025-65821 (CVSS 7.5) — As UART download mode is still enabled on the ESP32 chip on which the firmware runs, an adversary can dump the…
    CVE-2025-65092 (CVSS 6.9) — ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.1, 5.4.3, and 5.3.4, …
    CVE-2021-41104 (CVSS 7.5) — ESPHome is a system to control the ESP8266/ESP32. Anyone with web_server enabled and HTTP basic auth configure…
    CVE-2021-28139 (CVSS 8.8) — The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly restrict the Featu…
    CVE-2021-28136 (CVSS 6.5) — The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly handle the recepti…
    CVE-2021-34173 (CVSS 7.5) — An attacker can cause a Denial of Service and kernel panic in v4.2 and earlier versions of Espressif esp32 via…

    References

    https://cheriot.org/auditing/backdoor/2025/03/09/no-esp32-style-backdoor.html
    https://darkmentor.com/blog/esp32_non-backdoor/
    https://flyingpenguin.com/?p=67838
    https://github.com/TarlogicSecurity/Talks/blob/main/2025_RootedCon_BluetoothTools.pdf
    https://github.com/em0gi/CVE-2025-27840
    https://github.com/esphome/esphome/discussions/8382
    https://github.com/orgs/espruino/discussions/7699
    https://news.ycombinator.com/item?id=43301369
    https://news.ycombinator.com/item?id=43308740
    https://reg.rootedcon.com/cfp/schedule/talk/5
    https://www.bleepingcomputer.com/news/security/undocumented-backdoor-found-in-bluetooth-chip-used-by-a-billion-devices/
    https://www.bleepingcomputer.com/news/security/undocumented-commands-found-in-bluetooth-chip-used-by-a-billion-devices/
    https://www.espressif.com/en/news/Response_ESP32_Bluetooth
    https://www.tarlogic.com/news/backdoor-esp32-chip-infect-ot-devices/
    https://x.com/pascal_gujer/status/1898442439704158276

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High