AUMA: Incorrect delivery status of the Bluetooth configuration
Priority LOW 19CWE-207Published · Updated
Key facts
- Attack vector
- Adjacent network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
Due to an undocumented active bluetooth stack on products delivered within the period 01.01.2024 to 09.05.2025 fingerprinting is possible by an unauthenticated adjacent attacker.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00207 10th percentileScored 2026-11-07
Fix Fixed AC1.2 (Auma): 09.05.2025PROFOX (Auma): 09.05.2025
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA AC1.2 (Auma) Fixed in 09.05.2025
- Fix · CNA PROFOX (Auma) Fixed in 09.05.2025
Timeline
- 2026-10-02 Threatist record created from CVE-2025-41657
- 2026-10-03 Alias added: GHSA-w6h2-p5q3-p762
References
Sources
- CVE-2025-41657 · CVE Program
- CVE-2025-41657 · NVD
- FIRST EPSS
- GHSA-w6h2-p5q3-p762 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences