Rtl8762e Software Development Kit CVE-2025-44531

While the CVSS 3.1 score of 7.5 is elevated, real-world risk depends on deployment context: The attack vector is Network (AV:N) and requires no privileges (PR:N), indicating relatively easy exploitation from any device within Bluetooth range (typically 10-100 meters). Attack Complexity is Low (AC:L), meaning no special conditions are needed. However, the impact is limited to Availability (A:H) with no Confidentiality or Integrity impact—attackers cannot steal data or modify device behavior, only disrupt service. This is a classic DoS vector suitable for targeted disruption but not critical infrastructure compromise. The vulnerability requires the target device to be in active pairing mode, which is a temporal constraint that reduces real-world exposure. Without disclosed EPSS scores or KEV inclusion confirmation, and absent public POC code, exploitation is likely limited to informed threat actors. Priority should be medium-to-high for IoT/wearable manufacturers using this SDK, but lower for organizations where Bluetooth pairing is not frequently initiated or is air-gapped. The fix appears straightforward (input validation in pairing state machine), suggesting a patch will be released promptly.

An attacker with a Bluetooth-capable device (smartphone, laptop, or BLE sniffer) approaches a target IoT device (e.g., fitness tracker, smart lock, or wearable) that is actively in pairing mode (factory reset or re-pairing operation). The attacker uses off-the-shelf BLE tools (e.g., nRF Connect, Bluetooth packet injection via custom firmware on a compatible chipset) to craft a malformed Bluetooth pairing frame that violates the expected packet structure for public key exchange. This frame is transmitted before the legitimate pairing handshake is complete. Upon receipt, the RTL8762E stack's pairing state machine fails to validate the packet structure and enters an uncontrolled resource consumption loop—potentially exhausting heap memory, filling the stack, or triggering an infinite loop. Within seconds to minutes, the target device becomes unresponsive, loses Bluetooth connectivity, and may require a hard reset. The attacker requires physical proximity (Bluetooth range) and the device must be in pairing mode, but no authentication or prior relationship with the device is needed. No public proof-of-concept code has been disclosed, but exploitation would be straightforward for skilled adversaries with Bluetooth protocol knowledge and access to BLE packet injection tools.