CVE-2025-10457

Published: Sep 19, 2025Modified: Jun 17, 2026

8.1

Vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Exploitability: 2.8 / Impact: 5.2

Source: NVD

Description

The function responsible for handling BLE connection responses does not verify whether a response is expected—that is, whether the device has initiated a connection request. Instead, it relies solely on identifier matching.

Affected (1)

Products: Zephyrproject: Zephyr

Zephyrproject

1 product

Zephyr

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Zephyrproject Zephyr	Up to 4.1.0

Related CWEs

CWE-358

Improperly Implemented Security Check for Standard

The product does not implement or incorrectly implements one or more security-relevant checks as specified by the design of a standardized algorithm, protocol, or technique.

References (1)

https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-xqj6-vh76-2vv8

Source: vulnerabilities@zephyrproject.org

ExploitVendor Advisory

Timeline

No history available yet.