Zephyr RTOS CVE-2025-10457

Exploitation requires the attacker to be within Bluetooth Low Energy radio range of a Zephyr device that uses the BLE connection stack (hence CVSS AV:A, not AV:N). The specific defect is that the BLE connection-response handler validates only identifier matching and does not verify that a connection request was actually initiated, so an attacker can inject an unsolicited response at any time the device is in a susceptible connection state. No authentication or user interaction is needed (PR:N/UI:N). LIMITING FACTORS: physical proximity / RF range is mandatory (no remote internet exploitation), the target must be a BLE-enabled build of Zephyr using the affected connection-handling path, and impact is confined to connection integrity and availability - there is no confidentiality/data-disclosure impact per C:N.

Signals are mixed but lean toward a genuine-but-bounded risk. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N, I:H/A:H) scores 8.1 HIGH: an adjacent, low-complexity, unauthenticated attacker within BLE radio range can forge connection responses to spoof the integrity of the connection state and degrade availability, with no confidentiality impact (C:N). Against this, EPSS is only 0.04% (11th percentile), and the CVE is NOT on CISA KEV, so there is no evidence of active or widespread exploitation. A POC/exploit is publicly available per the Zephyr GHSA advisory, which raises practical feasibility, but POC availability is distinct from active exploitation and should not be read as 'in the wild.' The AV:A requirement (physical BLE proximity, not internet-routable) is the single biggest limiter: this cannot be mass-exploited remotely, which is consistent with the low EPSS. NOTE A CONFLICT: the input Tags label this 'Information Disclosure,' yet the CVSS vector sets C:N - the actual impact is integrity/availability (connection spoofing), not disclosure; treat the 'Information Disclosure' tag as unreliable and verify against the Zephyr advisory. Net: a real priority for BLE-connected embedded deployments reachable by a nearby attacker, but not an internet-facing emergency.

An attacker within Bluetooth Low Energy radio range of a Zephyr-based device transmits an unsolicited, crafted BLE connection response whose identifier matches the target; because the stack only checks identifier matching and not whether a corresponding request was actually initiated, the device accepts the unexpected response. This lets the attacker spoof or hijack the connection state, corrupting integrity and disrupting availability. Public exploit code referenced in the Zephyr security advisory makes this low-complexity attack practically reproducible.