CVE-2025-41725

MediumCVSS 6.5/10Last modified Nov 13, 2026

Description

Affected devices running firmware versions prior to 4.1.0 may crash and become unavailable when receiving specific malformed Bluetooth messages from an unauthenticated attacker.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-923

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Nov 13, 2026
Last modified: Nov 13, 2026
NVD status: Received

Related CVEs from 2025

CVE-2025-417268.8A low privileged remote attacker can execute arbitrary code by sending specially crafted calls to the web service of the Device Manager or l CVE-2025-417277.8A local low privileged attacker can bypass the authentication of the Device Manager user interface, allowing them to perform privileged oper CVE-2025-417285.3A low privileged remote attacker may be able to disclose confidential information from the memory of a privileged process by sending special CVE-2025-417297.5An unauthenticated remote attacker can send a specially crafted Modbus read command to the device which leads to a denial of service.CVE-2025-41738.8A vulnerability classified as critical was found in SourceCodester Online Eyewear Shop 1.0. Affected by this vulnerability is the function d CVE-2025-417309.8An unauthenticated remote attacker can abuse unsafe sscanf calls within the check_account() function to write arbitrary data into fixed-size CVE-2025-417317.4A vulnerability was identified in the password generation algorithm when accessing the debug-interface. An unauthenticated local attacker wi CVE-2025-417329.8An unauthenticated remote attacker can abuse unsafe sscanf calls within the check_cookie() function to write arbitrary data into fixed-size CVE-2025-417339.8The commissioning wizard on the affected devices does not validate if the device is already initialized. An unauthenticated remote attacker CVE-2025-417349.8An unauthenticated remote attacker can execute arbitrary php files and gain full access of the affected devices.CVE-2025-417358.8A low privileged remote attacker can upload any file to an arbitrary location due to missing file check resulting in remote code execution.CVE-2025-417368.8A low privileged remote attacker can upload a new or overwrite an existing python script by using a path traversal of the target filename in