CVE-2025-64342
Unknown Unknown - Not Provided

BaseFortify

Publication date: 2025-11-17

Last updated on: 2025-11-17

Assigner: GitHub, Inc.

Description
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. When the ESP32 is in advertising mode, if it receives a connection request containing an invalid Access Address (AA) of 0x00000000 or 0xFFFFFFFF, advertising may stop unexpectedly. In this case, the controller may incorrectly report a connection event to the host, which can cause the application layer to assume that the device has successfully established a connection. This issue has been fixed in versions 5.5.2, 5.4.3, 5.3.5, 5.2.6, and 5.1.7. At time of publication versions 5.5.2, 5.3.5, and 5.1.7 have not been released but are fixed respectively in commits 3b95b50, e3d7042, and 75967b5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2025-11-17
Last Modified
2025-11-17
Generated
2026-07-06
AI Q&A
2025-11-17
EPSS Evaluated
2026-07-05
NVD
CVE-2025-64342
EUVD
EUVD-2025-197854

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
espressif iot_development_framework *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-754 The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability occurs in the Espressif Internet of Things Development Framework (ESF-IDF) when the ESP32 device is in advertising mode. If the device receives a connection request with an invalid Access Address (AA) of 0x00000000 or 0xFFFFFFFF, the advertising process may stop unexpectedly. Additionally, the controller might incorrectly report a successful connection event to the host, causing the application layer to mistakenly believe a connection has been established.

Impact Analysis

The impact of this vulnerability is that the ESP32 device may stop advertising unexpectedly, which can disrupt normal device operation and connectivity. Moreover, the application layer may be misled into thinking a connection has been successfully made when it has not, potentially causing incorrect application behavior or logic errors.

Mitigation Strategies

Update the ESF-IDF to a fixed version: 5.5.2, 5.4.3, 5.3.5, 5.2.6, or 5.1.7, as these versions contain the fix for the vulnerability where advertising may stop unexpectedly due to invalid Access Address values.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-64342. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart