« Volver al listado

CVE-2025-68473

Estado: AnalizadaNinguna (0)—

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earlier, in the ESP-IDF Bluetooth host stack (BlueDroid), the function bta_dm_sdp_result() used a fixed-size array uuid_list[32][MAX_UUID_SIZE] to store discovered service UUIDs during the SDP (Service Discovery Protocol) process. On modern Bluetooth devices, it is possible for the number of available services to exceed this fixed limit (32). In such cases, if more than 32 services are discovered, subsequent writes to uuid_list could exceed the bounds of the array, resulting in a potential out-of-bounds write condition.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Espressif — Esp-idf

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-68473",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-68473",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-12-29T16:44:09.956137Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.6,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 4.7,
        "exploitabilityScore": 3.9
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 0,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "espressif",
          "product": "esp-idf",
          "versions": [
            {
              "status": "affected",
              "version": ">= 5.5-beta1, <= 5.5.1"
            },
            {
              "status": "affected",
              "version": ">= 5.4-beta1, <= 5.4.3"
            },
            {
              "status": "affected",
              "version": ">= 5.3-beta1, <= 5.3.4"
            },
            {
              "status": "affected",
              "version": ">= 5.2-beta1, <= 5.2.6"
            },
            {
              "status": "affected",
              "version": "<= 5.1.6"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-12-27T00:15:42.323",
  "references": [
    {
      "url": "https://github.com/espressif/esp-idf/commit/3286e45349b0b5c2b1422ef7e8d088b95eef895d",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/espressif/esp-idf/commit/4d928f2265c394d2abc85024228e920a5b26bcab",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/espressif/esp-idf/commit/5b3185168dae83d42aa0852689422fffd931f16c",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/espressif/esp-idf/commit/6453f57a954458ad8ffd6e4bf2d9e76b73fac0f1",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/espressif/esp-idf/commit/6ca6f422dafaffcb88fa56cc458ce92d96be3b2e",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/espressif/esp-idf/commit/9889edd799cf369e082df9d01adba961d64693ed",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/espressif/esp-idf/commit/ecb86d353640cf1375bf97db32e702ba59c551b6",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/espressif/esp-idf/security/advisories/GHSA-hmjj-rjvv-w8pq",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earlier, in the ESP-IDF Bluetooth host stack (BlueDroid), the function bta_dm_sdp_result() used a fixed-size array uuid_list[32][MAX_UUID_SIZE] to store discovered service UUIDs during the SDP (Service Discovery Protocol) process. On modern Bluetooth devices, it is possible for the number of available services to exceed this fixed limit (32). In such cases, if more than 32 services are discovered, subsequent writes to uuid_list could exceed the bounds of the array, resulting in a potential out-of-bounds write condition."
    },
    {
      "lang": "es",
      "value": "ESF-IDF es el Framework de Desarrollo de Espressif para el Internet de las Cosas (IoT). En las versiones 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6 y anteriores, en la pila de host Bluetooth de ESP-IDF (BlueDroid), la función bta_dm_sdp_result() utilizaba un array de tamaño fijo uuid_list[32][MAX_UUID_SIZE] para almacenar los UUID de servicio descubiertos durante el proceso SDP (Protocolo de Descubrimiento de Servicio). En dispositivos Bluetooth modernos, es posible que el número de servicios disponibles exceda este límite fijo (32). En tales casos, si se descubren más de 32 servicios, las escrituras posteriores en uuid_list podrían exceder los límites del array, lo que resultaría en una posible condición de escritura fuera de límites."
    }
  ],
  "lastModified": "2026-10-05T19:10:00.210",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:espressif:esp-idf:5.1.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "90D991F0-A03E-44CF-9187-75897399797A"
            },
            {
              "criteria": "cpe:2.3:a:espressif:esp-idf:5.2.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "37A040C2-E9D4-4678-9A10-74B5AEE4901D"
            },
            {
              "criteria": "cpe:2.3:a:espressif:esp-idf:5.3.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AA4D9168-C8C1-4B1A-81C3-D4888DB36CAE"
            },
            {
              "criteria": "cpe:2.3:a:espressif:esp-idf:5.4.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7CA4F443-03D3-4B10-909E-A813F72BC08C"
            },
            {
              "criteria": "cpe:2.3:a:espressif:esp-idf:5.5.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C84481DF-BAFA-4644-B5B1-1F9BB5F535E4"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}