CVE-2025-12890

MediumCVSS 6.5/10Last modified Oct 13, 2026

Description

Improper handling of malformed Connection Request with the interval set to be 1 (which supposed to be illegal) and the chM 0x7CFFFFFFFF triggers a crash. The peripheral will not be connectable after it.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-703

Affected software

No affected versions have been published.

Timeline

Published: Nov 7, 2025
Last modified: Oct 13, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-128915.3The Survey Maker plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'ays_survey_show CVE-2025-128925.3The Survey Maker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the deactivate CVE-2025-128935.4Clients may successfully perform a TLS handshake with a MongoDB server despite presenting a client certificate not aligning with the documen CVE-2025-128945.3The Import WP – Export and Import CSV and XML files to WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all CVE-2025-128955.3The Kalium 3 | Creative WordPress & WooCommerce Theme theme for WordPress is vulnerable to unauthorized email sending due to a missing capab CVE-2025-128964.4Improper resource management in firmware of some Solidigm DC Products may allow an attacker with local or physical access to gain un-authori CVE-2025-128985.3The Pretty Google Calendar plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the pgcal_CVE-2025-128996.5A flaw in Zephyr’s network stack allows an IPv4 packet containing ICMP type 128 to be misclassified as an ICMPv6 Echo Request. This results CVE-2025-12908.1A race condition Use-After-Free vulnerability exists in the virtio_transport_space_update function within the Kernel 5.4 on ChromeOS. Concur CVE-2025-129004.3The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to missing authorization in all versions up CVE-2025-129014.3The Asgaros Forum plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.1. This is due CVE-2025-129024.4Improper resource management in firmware of some Solidigm DC Products may allow an attacker with local or physical access to gain un-authori