{"id":"CVE-2024-2105","aliases":["EUVD-2024-27069","GHSA-6238-89rc-fwrc"],"status":"published","title":"JBL: Improper validation of ICM field in connection requests","description":"An unauthorised attacker within bluetooth range may use an improper validation during the BLE connection request to deadlock the affected devices.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00212,"percentile":0.11602,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-1287"],"published":"2025-12-10T13:01:54Z","modified":"2026-10-27T18:10:00Z","products":[{"vendor":"jbl","product":"boombox 2"},{"vendor":"jbl","product":"boombox 3"},{"vendor":"jbl","product":"flip 5"},{"vendor":"jbl","product":"flip 6"},{"vendor":"jbl","product":"pulse 4"},{"vendor":"jbl","product":"pulse 5"},{"vendor":"jbl","product":"xtreme 3"}],"references":[{"url":"https://harman.csaf-tp.certvde.com/.well-known/csaf/white/2025/hbsa-2025-0002.json","tags":["vendor-advisory"]},{"url":"https://certvde.com/en/advisories/VDE-2025-089"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-2105"},{"url":"https://github.com/advisories/GHSA-6238-89rc-fwrc"}],"sources":{"cve":[{"id":"CVE-2024-2105","title":"JBL: Improper validation of ICM field in connection requests","description":"An unauthorised attacker within bluetooth range may use an improper validation during the BLE connection request to deadlock the affected devices.","status":"published","published":"2025-12-10T13:01:54.421Z","modified":"2025-12-10T15:49:54.79Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-1287"],"updated_at":"2026-11-02T14:34:10.258163Z"}],"euvd":[{"id":"EUVD-2024-27069","description":"An unauthorised attacker within bluetooth range may use an improper validation during the BLE connection request to deadlock the affected devices.","status":"published","published":"2025-12-10T13:01:54Z","modified":"2025-12-10T15:49:54Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T19:49:07.561853Z"}],"ghsa":[{"id":"GHSA-6238-89rc-fwrc","title":"An unauthorised attacker within bluetooth range may use an improper validation during the BLE...","description":"An unauthorised attacker within bluetooth range may use an improper validation during the BLE connection request to deadlock the affected devices.","status":"published","published":"2025-12-10T15:31:23Z","modified":"2025-12-10T15:31:29Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-1287"],"updated_at":"2026-11-02T15:05:07.56832Z"}],"nvd":[{"id":"CVE-2024-2105","description":"An unauthorised attacker within bluetooth range may use an improper validation during the BLE connection request to deadlock the affected devices.","status":"published","published":"2025-12-10T13:16:02.793Z","modified":"2026-10-27T18:10:00.13Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-1287"],"updated_at":"2026-11-02T14:10:47.444899Z"}]}}