Vulnerability in Espressif Esp32
CVE-2025-27840
Espressif ESP32 chips allow 29 hidden HCI commands, such as 0xFC02 (Write memory).
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L.
EPSS exploit prediction
EPSS 0.014, 71.9th percentile (scored ); unchanged over 30 days. About EPSS.
Affected products
- Espressif Esp32 — versions 2025-03-06
- Espressif Esp32 Firmware
Weakness classification (CWE)
Public exploits and proof-of-concept code
6 public repositories with exploit or proof-of-concept code for this CVE:
- demining/Bluetooth-Attacks-CVE-2025-27840 (13 stars, last pushed 2025-03-30): Bitcoin Cryptanalysis: CVE-2025-27840 Vulnerability in ESP32 Microcontrollers Puts Billions of IoT Devices at Risk via Wi-Fi & Bluetooth
- em0gi/CVE-2025-27840 (11 stars, last pushed 2025-03-09): Expanded version of the code shown at RootedCON redone in python - CVE-2025-27840
- JasonW88/esp32-cve-2025-27840-power-trace-experiment (last pushed 2026-08-05): Firmware for getting a power trace of the behavior of the bluetooth module on the ESP32 when the ESP32 is sent the undocumented hci bluetooth commands (CVE-2025-27840). Uses ESP-IDF v5.0.8 and v5.0.9.
- h4r-m0n1e/CVE-2025-27840-WIP (last pushed 2025-04-08): A Work-In-Progress for CVE-2025-27840
- ladyg00se/CVE-2025-27840-WIP (last pushed 2025-04-08): A Work-In-Progress for CVE-2025-27840
- v3ilsm1th/CVE-2025-27840-WIP (last pushed 2025-04-08): A Work-In-Progress for CVE-2025-27840
Also mentioned in 16 other repositories (0xMarcio/cve, Alirezarv700/CryptoDeepTools, antoniovazquezblanco/advisories, …). These reference the CVE in a list, notes or a scanner and are not exploit code for it.
References
- github.com/TarlogicSecurity/Talks/blob/main/2025_RootedCon_BluetoothTools.pdf (Third Party Advisory)
- x.com/pascal_gujer/status/1898442439704158276 (Third Party Advisory)
- www.tarlogic.com/news/backdoor-esp32-chip-infect-ot-devices/ (Third Party Advisory)
- www.bleepingcomputer.com/news/security/undocumented-backdoor-found-in-bluetooth… (Exploit, Press/Media Coverage)
- reg.rootedcon.com/cfp/schedule/talk/5 (Third Party Advisory)
- flyingpenguin.com/ (Technical Description, Third Party Advisory)
- github.com/em0gi/CVE-2025-27840 (Product)
- github.com/orgs/espruino/discussions/7699 (Issue Tracking)
- www.bleepingcomputer.com/news/security/undocumented-commands-found-in-bluetooth… (Exploit, Press/Media Coverage)
- darkmentor.com/blog/esp32_non-backdoor/ (Technical Description, Exploit, Third Party Advisory)
This CVE has public exploit evidence. See the latest CVEs with public exploits.