{"id":"CVE-2025-27840","aliases":["EUVD-2025-7816","GHSA-jfwf-rfmg-7f8m"],"status":"published","title":"Espressif ESP32 chips allow 29 hidden HCI commands, such as 0xFC02 (Write memory).","description":"Espressif ESP32 chips allow 29 hidden HCI commands, such as 0xFC02 (Write memory).","severity":{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.01356,"percentile":0.72013,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-912"],"published":"2025-03-08T00:00:00Z","modified":"2026-06-17T09:04:19Z","exploits":[{"source":"pocgithub","id":"em0gi/CVE-2025-27840","title":"em0gi/CVE-2025-27840","date":"2025-03-09","url":"https://github.com/em0gi/CVE-2025-27840"},{"source":"pocgithub","id":"demining/Bluetooth-Attacks-CVE-2025-27840","title":"demining/Bluetooth-Attacks-CVE-2025-27840","date":"2025-03-30","url":"https://github.com/demining/Bluetooth-Attacks-CVE-2025-27840"},{"source":"pocgithub","id":"h4r-m0n1e/CVE-2025-27840-WIP","title":"h4r-m0n1e/CVE-2025-27840-WIP","date":"2025-04-08","url":"https://github.com/h4r-m0n1e/CVE-2025-27840-WIP"},{"source":"pocgithub","id":"JasonW88/esp32-cve-2025-27840-power-trace-experiment","title":"JasonW88/esp32-cve-2025-27840-power-trace-experiment","date":"2026-08-05","url":"https://github.com/JasonW88/esp32-cve-2025-27840-power-trace-experiment"}],"products":[{"vendor":"espressif","product":"esp32"},{"vendor":"espressif","product":"esp32_firmware"}],"references":[{"url":"https://github.com/TarlogicSecurity/Talks/blob/main/2025_RootedCon_BluetoothTools.pdf","tags":["Third Party Advisory"]},{"url":"https://x.com/pascal_gujer/status/1898442439704158276","tags":["Third Party Advisory"]},{"url":"https://www.tarlogic.com/news/backdoor-esp32-chip-infect-ot-devices/","tags":["Third Party Advisory"]},{"url":"https://www.bleepingcomputer.com/news/security/undocumented-backdoor-found-in-bluetooth-chip-used-by-a-billion-devices/","tags":["Exploit","Press/Media Coverage"]},{"url":"https://reg.rootedcon.com/cfp/schedule/talk/5","tags":["Third Party Advisory"]},{"url":"https://flyingpenguin.com/?p=67838","tags":["Technical Description","Third Party Advisory"]},{"url":"https://github.com/em0gi/CVE-2025-27840","tags":["Product"]},{"url":"https://github.com/orgs/espruino/discussions/7699","tags":["Issue Tracking"]},{"url":"https://www.bleepingcomputer.com/news/security/undocumented-commands-found-in-bluetooth-chip-used-by-a-billion-devices/","tags":["Exploit","Press/Media Coverage"]},{"url":"https://darkmentor.com/blog/esp32_non-backdoor/","tags":["Exploit","Technical Description","Third Party Advisory"]},{"url":"https://news.ycombinator.com/item?id=43308740","tags":["Issue Tracking"]},{"url":"https://news.ycombinator.com/item?id=43301369","tags":["Issue Tracking"]},{"url":"https://github.com/esphome/esphome/discussions/8382","tags":["Issue Tracking"]},{"url":"https://cheriot.org/auditing/backdoor/2025/03/09/no-esp32-style-backdoor.html","tags":["Technical Description","Third Party Advisory"]},{"url":"https://www.espressif.com/en/news/Response_ESP32_Bluetooth","tags":["Press/Media Coverage"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-27840"},{"url":"https://www.bleepingcomputer.com/news/security/undocumented-backdoor-found-in-bluetooth-chip-used-by-a-billion-devices"},{"url":"https://www.tarlogic.com/news/backdoor-esp32-chip-infect-ot-devices"},{"url":"https://www.bleepingcomputer.com/news/security/undocumented-commands-found-in-bluetooth-chip-used-by-a-billion-devices"},{"url":"https://darkmentor.com/blog/esp32_non-backdoor"},{"url":"https://github.com/advisories/GHSA-jfwf-rfmg-7f8m"}],"sources":{"cve":[{"id":"CVE-2025-27840","description":"Espressif ESP32 chips allow 29 hidden HCI commands, such as 0xFC02 (Write memory).","status":"published","published":"2025-03-08T00:00:00Z","modified":"2025-05-12T15:33:14.134Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-912"],"updated_at":"2026-11-02T14:32:42.411662Z"}],"euvd":[{"id":"EUVD-2025-7816","description":"Espressif ESP32 chips allow 29 hidden HCI commands, such as 0xFC02 (Write memory).","status":"published","published":"2025-03-08T00:00:00Z","modified":"2025-05-12T15:33:14Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T20:32:49.812342Z"}],"ghsa":[{"id":"GHSA-jfwf-rfmg-7f8m","title":"Espressif ESP32 chips allow 29 hidden HCI commands, such as 0xFC02 (Write memory).","description":"Espressif ESP32 chips allow 29 hidden HCI commands, such as 0xFC02 (Write memory).","status":"published","published":"2025-03-08T21:30:52Z","modified":"2025-03-11T18:32:12Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L","level":"medium"}],"cwes":["CWE-912"],"updated_at":"2026-11-02T15:00:13.348755Z"}],"nvd":[{"id":"CVE-2025-27840","description":"Espressif ESP32 chips allow 29 hidden HCI commands, such as 0xFC02 (Write memory).","status":"published","published":"2025-03-08T20:15:36.027Z","modified":"2026-06-17T09:04:19.343Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-912"],"updated_at":"2026-11-02T14:10:53.101324Z"}]}}