CVE-2025-41725 - Vulnerability Details - OpenCVE

Affected devices running firmware versions prior to 4.1.0 may crash and become unavailable when receiving specific malformed Bluetooth messages from an unauthenticated attacker.

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Jbl	Flip 4

No data.

No data.

References

Link	Providers
https://certvde.com/en/advisories/VDE-2025-090/
https://harman.csaf-tp.certvde.com/.well-known/csaf/white/2026/hbsa-2025-0003.json

History

Fri, 13 Nov 2026 15:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Jbl Jbl flip 4
CPEs		cpe:2.3:a:jbl:flip_4::::::::
Vendors & Products		Jbl Jbl flip 4

Fri, 13 Nov 2026 13:15:00 +0000

Type	Values Removed	Values Added
Description		Affected devices running firmware versions prior to 4.1.0 may crash and become unavailable when receiving specific malformed Bluetooth messages from an unauthenticated attacker.
Title		DoS vulnerability in JBL Flip 4
Weaknesses		CWE-923
References		https://certvde.com/en/advisories/VDE-2025-090/ https://harman.csaf-tp.certvde.com/.well-known/csaf/white/2026/hbsa-2025-0003.json
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`

MITRE

Status: PUBLISHED

Assigner: CERTVDE

Published: 2026-11-13T12:59:24.549Z

Updated: 2026-11-13T21:01:59.702Z

Reserved: 2025-04-16T11:17:48.318Z

Link: CVE-2025-41725

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-11-13T13:17:38.957

Modified: 2026-11-13T23:10:00.153

Link: CVE-2025-41725

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-41725", "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "state": "PUBLISHED", "assignerShortName": "CERTVDE", "dateReserved": "2025-04-16T11:17:48.318Z", "datePublished": "2026-11-13T12:59:24.549Z", "dateUpdated": "2026-11-13T21:01:59.702Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Flip 4", "vendor": "JBL", "versions": [{"lessThan": "4.1.0", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:jbl:flip_4:*:*:*:*:*:*:*:*", "versionEndExcluding": "4.1.0", "versionStartIncluding": "0.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "OR"}], "credits": [{"lang": "en", "type": "finder", "value": "Justus W. Perlwitz from JWP Consulting"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Affected devices running firmware versions prior to 4.1.0 may crash and become unavailable when receiving specific malformed Bluetooth messages from an unauthenticated attacker.</p>"}], "value": "Affected devices running firmware versions prior to 4.1.0 may crash and become unavailable when receiving specific malformed Bluetooth messages from an unauthenticated attacker."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-923", "description": "CWE-923 Improper Restriction of Communication Channel to Intended Endpoints", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "shortName": "CERTVDE", "dateUpdated": "2026-11-13T15:03:50.513Z"}, "references": [{"tags": ["x_csaf", "vendor-advisory"], "url": "https://harman.csaf-tp.certvde.com/.well-known/csaf/white/2026/hbsa-2025-0003.json"}, {"tags": ["vendor-advisory"], "url": "https://certvde.com/en/advisories/VDE-2025-090/"}], "source": {"advisory": "VDE-2025-090", "defect": ["TODO"], "discovery": "UNKNOWN"}, "title": "DoS vulnerability in JBL Flip 4", "x_generator": {"engine": "Vulnogram 0.4.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-13T21:01:50.713795Z", "id": "CVE-2025-41725", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-13T21:01:59.702Z"}}]}}