What’s Vulnerable › Vulnerabilities

CVE-2025-69969

• Severity: critical (CVSS 9.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-03-04 · updated 2026-06-17
• Weakness: CWE-311

Description

A lack of authentication and authorization mechanisms in the Bluetooth Low Energy (BLE) communication protocol of SRK Powertech Pvt Ltd Pebble Prism Ultra v2.9.2 allows attackers to reverse engineer the protocol and execute arbitrary commands on the device without establishing a connection. This is exploitable over Bluetooth Low Energy (BLE) proximity (Adjacent), requiring no physical contact with the device. Furthermore, the vulnerability is not limited to arbitrary commands but includes cleartext data interception and unauthenticated firmware hijacking via OTA services.

Affected products

• Pebblepower Pebble Prism Ultra Firmware: before 2.5.8 — fixed in 2.5.8

How to fix

Upgrade to a fixed version: Pebblepower Pebble Prism Ultra Firmware 2.5.8. Check the vendor advisory for mitigations.

References

• https://github.com/mukundbhuva/BLEached-Security
• https://github.com/mukundbhuva/BLEached-Security/security/advisories/GHSA-cp6q-87g8-mq77

Get alerted when CVE-2025-69969 or the next vulnerability affects your stack