Description
Due to improper BLE security configurations on the device's GATT server, an adjacent unauthenticated attacker can read and write device control commands through the mobile app service wich could render the device unusable.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| JBL | LIVE PRO 2 TWS | — | — |
| JBL | TUNE FLEX | — | — |
Advisories 1
- HBSA-2025-0001 BLE GATT Service Vulnerability in JBL Headphones CERT@VDE · Dec 10, 2025
References
- https://harman.csaf-tp.certvde.com/.well-known/csaf/white/2025/hbsa-2025-0001.json vendor-advisory
- https://certvde.com/en/advisories/VDE-2024-076 vendor-advisory