CVE-2025-27840

Published Mar 8, 2025

Last updated a month ago

Espressif

Overview

AI description

Generated using AI and has not been reviewed by Intruder. May contain errors.

CVE-2025-27840 is a vulnerability found in Espressif ESP32 chips. These chips permit 29 undocumented HCI commands, including a command (0xFC02) that allows writing to memory. This vulnerability was first publicly disclosed on March 8, 2025. Additional information regarding this vulnerability can be found on sites such as the National Vulnerability Database (NVD) and GitHub's Advisory Database.

Description: Espressif ESP32 chips allow 29 hidden HCI commands, such as 0xFC02 (Write memory).
Source: cve@mitre.org
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 6.8
Impact score: 5.8
Exploitability score: 0.5
Vector string: CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
Severity: MEDIUM

Weaknesses

cve@mitre.org: CWE-912
nvd@nist.gov: NVD-CWE-Other

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 75

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:espressif:esp32_firmware:-:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "C81AEA93-C163-4E5C-A25D-D2903742C9EE"
          }
        ],
        "operator": "OR"
      },
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:h:espressif:esp32:-:*:*:*:*:*:*:*",
            "vulnerable": false,
            "matchCriteriaId": "D1024B06-380B-4116-B7F9-A21A03534B0C"
          }
        ],
        "operator": "OR"
      }
    ],
    "operator": "AND"
  }
]