What’s Vulnerable › Vulnerabilities

CVE-2024-2105: JBL: Improper validation of ICM field in connection requests

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-12-10 · updated 2026-10-27
• Weakness: CWE-1287

Description

An unauthorised attacker within bluetooth range may use an improper validation during the BLE connection request to deadlock the affected devices.

Affected products

• JBL Boombox 2: all versions
• JBL Boombox 3: all versions
• JBL Flip 5: all versions
• JBL Flip 6: all versions
• JBL Pulse 4: all versions
• JBL Pulse 5: all versions
• JBL Xtreme 3: all versions

References

• https://certvde.com/en/advisories/VDE-2025-089
• https://harman.csaf-tp.certvde.com/.well-known/csaf/white/2025/hbsa-2025-0002.json

Get alerted when CVE-2024-2105 or the next vulnerability affects your stack