What’s Vulnerable › Vulnerabilities

CVE-2024-2104: JBL: Improper BLE security configurations and lack of authentication on the device's GATT server

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-12-10 · updated 2026-06-17
• Weakness: CWE-306

Description

Due to improper BLE security configurations on the device's GATT server, an adjacent unauthenticated attacker can read and write device control commands through the mobile app service wich could render the device unusable.

Affected products

• JBL LIVE PRO 2 TWS: all versions
• JBL TUNE FLEX: all versions

References

• https://certvde.com/en/advisories/VDE-2024-076
• https://harman.csaf-tp.certvde.com/.well-known/csaf/white/2025/hbsa-2025-0001.json

Get alerted when CVE-2024-2104 or the next vulnerability affects your stack