Security Flaw Discovered in Bluetooth Chip Used by a Billion Devices Worldwide

Security Flaw Discovered in Bluetooth Chip Used by a Billion Devices Worldwide is easier to approach with a clear overview and reliable steps. This guide organizes the essential information, highlights practical details, and explains what to check along the way.

Backdoor in ESP32

In a presentation at RootedCON, Tarlogic researchers explained that interest in Bluetooth security research has declined, but not because the protocol or its implementations have become more secure.

Instead, most of the attacks presented last year had no working tools, were incompatible with mainstream hardware, and used outdated or unmaintained tools that are largely incompatible with modern systems.

Tarlogic has developed a new C-based, hardware-independent and cross-platform USB Bluetooth driver that allows direct access to the hardware without relying on operating system specific APIs.

Armed with this new tool, which allows raw access to Bluetooth traffic, Tarlogic discovered hidden vendor-specific commands (Opcode 0x3F) in the ESP32 Bluetooth firmware, allowing low-level control of Bluetooth functions.

In total, they found 29 undocumented commands, collectively described as a 'backdoor,' that can be abused for memory manipulation (read/write RAM and Flash), MAC address spoofing (device spoofing), and LMP/LLCP packet injection. The issue is currently tracked under the identifier CVE-2025-27840.

Potential Risks

Risks arising from these commands include malicious deployment at the OEM level and supply chain attacks.

Depending on how the Bluetooth stack handles HCI commands on the device, remote backdoor exploitation may be possible via malicious firmware or a spoofed Bluetooth connection.

This is especially true if the attacker already has root access, installs malware, or pushes a malicious update to the device, opening up low-level access.

However, in general, having physical access to a device's USB or UART interface is much more dangerous and a more realistic attack scenario.

" In a scenario where you can compromise an IoT device running an ESP32 chip, you would be able to hide an APT (Advanced Persistent Threat) in the ESP memory and perform Bluetooth (or Wi-Fi) attacks against other devices, while also controlling the device over Wi-Fi/Bluetooth," the team explains. " Our discovery would allow full control of the ESP32 chip and maintain persistence in the chip through commands that allow modification of RAM and Flash. Additionally, with persistence in the chip, it would be possible to spread to other devices because ESP32 allows for advanced Bluetooth attacks. "

Final Thoughts

The most reliable way to handle security flaw discovered in bluetooth chip used by a billion devices worldwide is to follow the process in order, verify each important setting, and test the result before moving on. Use the guidance above as a practical reference, then adjust the details for your device, software version, or specific goal.