Skip to content
OpenAdvisories
Medium · 5.3 Public exploit CVE-2025-15474 EUVD-2026-1271GHSA-hhwm-q72q-9mg9

AuntyFey Smart Combination Lock BLE Connection Flood DoS

Published Jan 7, 2026 · Updated Jan 7, 2026 · Assigned by VulnCheck

Vendor: AuntyFey Product: AuntyFey Smart Combination Lock

Description

AuntyFey Smart Combination Lock firmware versions as of 2025-12-24 contain a vulnerability that allows an unauthenticated attacker within Bluetooth Low Energy (BLE) range to cause a denial of service by repeatedly initiating BLE connections. Sustained connection attempts interrupt keypad authentication input and repeatedly force the device into lockout states, preventing legitimate users from unlocking the device.

Affected products

VendorProductAffectedFixed
AuntyFey AuntyFey Smart Combination Lock ≤ 2025-12-24 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • NSM-Barii/CVE-2025-15474 ★ 4 · Dec 24, 2025

    A denial-of-service vulnerability in the AuntyFey BLE smart padlock allows unauthenticated connection floods to lock out legitimate users. CVE-2025-15474

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References