Executive Summary

This vulnerability affects the Hero MotoCorp VIDA V1 Pro scooter firmware version 2.0.7. It arises because the BLE (Bluetooth Low Energy) component does not enforce authentication or bonding before accepting connections. An unauthenticated attacker within BLE range (~10 meters) can connect to the scooter's BLE interface without pairing or bonding, occupying the connection slot. This prevents the official My VIDA mobile app from connecting to the scooter, causing a temporary denial of service (DoS). The vulnerability does not affect confidentiality or integrity and does not allow code execution or permanent control over the device. [1]

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can cause a denial of service by blocking legitimate users from connecting their My VIDA mobile app to the scooter via BLE. An attacker can connect to the scooter's BLE interface without authentication, occupying the connection slot and preventing authorized app-based interactions temporarily. This results in users being locked out from controlling or interacting with their scooter through the official app until the unauthorized connection is terminated. [1]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by scanning for the scooter's BLE device named 'HMC_8810' using BLE scanning tools such as nRF Connect. Once the device is found, attempt to connect without pairing or bonding. If the connection is accepted without authentication and the official My VIDA app cannot connect afterward, the vulnerability is present. A suggested command using nRF Connect or similar BLE tools would be to scan for BLE devices and connect to 'HMC_8810' without pairing. For example, using nRF Connect's GUI to scan and connect or using command-line BLE tools to scan and connect to the device without authentication. [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include enforcing BLE pairing and bonding requirements on the device to prevent unauthenticated connections, implementing authenticated connection checks to reject unauthorized devices, requiring the official app to authenticate before establishing BLE sessions, rejecting unauthenticated connection attempts, and promptly closing stale or unauthorized BLE connections. [1]

Useful 0 Not Useful 0