Summary
The Bluetooth Classic implementation on JBL Flip 4 devices with firmware version prior to 4.1.0 does not properly
handle malformed LMP messages and causes the entire device to crash. Any attacker in radio range can
exploit this vulnerability.
Details
Impact
Any attacker in radio range can send malicious messages to cause the device to crash.
Mitigation
There is no known mitigation at this moment.
Remediation
The vulnerability is fixed in firmware version 4.1.0.
Product Description
The JBL Flip 4 is a portable bluetooth speaker.
Vulnerabilities 1
-
Medium 6.5
DoS vulnerability in JBL Flip 4
Affected devices running firmware versions prior to 4.1.0 may crash and become unavailable when receiving specific malformed Bluetooth messages from an unauthenticated attacker.
Revision history
-
#2.0.0
fixed alias, added cpes, fixed version_range
-
#1.0.0
Initial release.
References
-
CERT@VDE Security Advisories for Harman
https://certvde.com/en/advisories/vendor/harmann/
-
HBSA-2025-0003: JBL: DoS vulnerability in Flip 4 - HTML
https://certvde.com/en/advisories/VDE-2025-090
-
Braktooth, a description of a family of security vulnerabilities in commercial BT stacks.
https://asset-group.github.io/disclosures/braktooth/