CVE-2025-64342
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-11-17

Last updated on: 2025-11-17

Assigner: GitHub, Inc.

Description
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. When the ESP32 is in advertising mode, if it receives a connection request containing an invalid Access Address (AA) of 0x00000000 or 0xFFFFFFFF, advertising may stop unexpectedly. In this case, the controller may incorrectly report a connection event to the host, which can cause the application layer to assume that the device has successfully established a connection. This issue has been fixed in versions 5.5.2, 5.4.3, 5.3.5, 5.2.6, and 5.1.7. At time of publication versions 5.5.2, 5.3.5, and 5.1.7 have not been released but are fixed respectively in commits 3b95b50, e3d7042, and 75967b5.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-11-17
Last Modified
2025-11-17
Generated
2026-06-16
AI Q&A
2025-11-17
EPSS Evaluated
2026-06-15
NVD
CVE-2025-64342
EUVD
EUVD-2025-197854
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
espressif iot_development_framework *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-754 The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability occurs in the Espressif Internet of Things Development Framework (ESF-IDF) when the ESP32 device is in advertising mode. If the device receives a connection request with an invalid Access Address (AA) of 0x00000000 or 0xFFFFFFFF, the advertising process may stop unexpectedly. Additionally, the controller might incorrectly report a successful connection event to the host, causing the application layer to mistakenly believe a connection has been established.

Impact Analysis

The impact of this vulnerability is that the ESP32 device may stop advertising unexpectedly, which can disrupt normal device operation and connectivity. Moreover, the application layer may be misled into thinking a connection has been successfully made when it has not, potentially causing incorrect application behavior or logic errors.

Mitigation Strategies

Update the ESF-IDF to a fixed version: 5.5.2, 5.4.3, 5.3.5, 5.2.6, or 5.1.7, as these versions contain the fix for the vulnerability where advertising may stop unexpectedly due to invalid Access Address values.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-64342. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart