Summary
The BLE controller in certain consumer products fails to properly validate the channel map field in connection requests, enabling attackers within radio range to cause a denial of service through a specially crafted packet.
Details
Impact
Sending an invalid connection request to a JBL Bluetooth Speaker causes it to crash or enter a deadlock state, halting music playback and disconnecting existing connections. Recovery requires manual reboot by the user, as reconnection is impossible in this state.
Remediation
No remediation is available as of now. A manual reboot of the device by the user is required to restore functionality.
Vulnerabilities 1
-
Medium 6.5
JBL: Improper validation of ICM field in connection requests
An unauthorised attacker within bluetooth range may use an improper validation during the BLE connection request to deadlock the affected devices.
Revision history
-
#1.0.0
Initial version
References
-
CERT@VDE Security Advisories for Harman
https://certvde.com/en/advisories/vendor/harmann/
-
HBSA-2025-0002: BLE ICM Vulnerability in JBL Headphones - HTML
https://certvde.com/en/advisories/VDE-2025-089