JXL Car Infotainment CVE-2025-63895
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessPosition within Bluetooth range
-
DeliveryCraft malformed LMP packet
-
ExploitSend to head unit's Bluetooth firmware
-
ExecutionTrigger improper resource release (CWE-404)
-
ImpactCrash/reboot infotainment (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Resource release
|
| Exploitation Conditions | Exploitation requires the attacker to be within classic Bluetooth (BR/EDR) radio range of the target JXL head unit and to have the device's Bluetooth radio powered on and reachable at the LMP/baseband layer; the crafted LMP packet is processed during link-layer negotiation, so no pairing, authentication (PR:N), or user interaction (UI:N) is needed. The key limiting factors are physical proximity (Bluetooth range, roughly ~10 meters for typical class-2 radios - this contradicts the CVSS AV:N label and is closer to AV:A) and the requirement that Bluetooth be enabled on the unit; only firmware version 12.0 of this specific JXL model is confirmed affected. Impact is limited to availability - no data disclosure or code execution. |
| Impact | The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) rates this network-reachable, unauthenticated, low-complexity, availability-only - a pure DoS with no confidentiality or integrity impact. The AV:N (network) label is questionable for a Bluetooth LMP attack: LMP requires the attacker to be within Bluetooth radio range of the target, which maps more accurately to AV:A (adjacent) and would lower the base score to ~6.5 - verify the attack vector, as physical proximity is a real limiting factor not reflected by AV:N. Supporting signals point to low real-world priority: EPSS is only 0.28% (20th percentile), the CVE is not in CISA KEV (no active exploitation), and no weaponized exploit is confirmed. Impact is also bounded - the worst outcome is a crash/reboot of an aftermarket car head unit, not code execution or data loss. Net assessment: genuine but low-severity, proximity-gated availability issue in a low-prevalence product; treat as low priority unless these specific units are in scope. |
| Exploit ScenarioDerived | An attacker sitting near a vehicle - in an adjacent car, parking lot, or drive-through - uses a Bluetooth radio to transmit a crafted LMP packet to the JXL head unit within radio range, causing its Bluetooth firmware to mishandle resources and crash. The infotainment system freezes or reboots, dropping any active hands-free call or audio; the attack can be repeated to sustain the denial of service. A researcher README documenting the CVE exists, but no full weaponized exploit is confirmed public. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 05, 2026
Denial of service in the Bluetooth firmware of the JXL 9-inch Car Android Double Din Player (Android v12.0) lets an attacker within Bluetooth range crash the head unit by sending a malformed Link Manager Protocol (LMP) packet. The flaw sits in the low-level Bluetooth baseband/link layer, so no pairing or user interaction is needed to disrupt availability of the in-vehicle infotainment system. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.28%, 20th percentile), consistent with a niche automotive product rather than a mass-exploited target.
RemediationAI
No vendor-released patch identified at time of analysis - there is no JXL advisory or fixed firmware version in the provided data, so patching cannot be confirmed. As compensating controls, disable or turn off Bluetooth on the head unit when not actively in use to remove the attack surface entirely (trade-off: loses hands-free calling and audio streaming); set the device to non-discoverable/non-connectable mode to reduce, though not eliminate, exposure to crafted LMP packets from unpaired devices; and keep the head unit physically out of range of untrusted parties, recognizing the attacker must be within Bluetooth radio distance. Because the impact is only a crash/reboot with no persistence, power-cycling restores service. Monitor JXL India for a firmware update and consult the researcher writeup at https://github.com/thorat-shubham/JXL_Infotainment_CVE-2025-63895/blob/main/README.md for technical details.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Link Manager Protocol (LMP) is the control-plane protocol of classic Bluetooth (BR/EDR) that runs between two devices' baseband controllers to negotiate connections, authentication, encryption, and link parameters before any higher-layer (L2CAP/RFCOMM) traffic. Because LMP is handled inside the Bluetooth controller firmware - below the operating system's Bluetooth stack - malformed LMP handling bugs are a recurring class in automotive and IoT SoCs. The CWE-404 (Improper Resource Shutdown or Release) classification indicates the firmware fails to properly free or reset resources when it receives a crafted/unexpected LMP packet, leading to resource exhaustion or an unrecoverable state that manifests as a crash. The CPE cpe:2.3:o:jxlindia:jxl_9_inch_car_android_double_din_player_firmware:12.0 identifies the affected component as the device firmware (operating-system-class CPE), specifically the Bluetooth firmware of this JXL Android 12.0 double-DIN head unit.
Know when Jxl 9 Inch Car Android Double Din Player Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Bluetooth LMP attack needs radio proximity so AV:A not AV:N; unauthenticated low-complexity link-layer packet (PR:N/AC:L); availability-only crash (A:H, C/I:N).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
DescriptionCVE.org
An issue in the Bluetooth firmware of JXL 9 Inch Car Android Double Din Player Android v12.0 allows attackers to cause a Denial of Service (DoS) via sending a crafted Link Manager Protocol (LMP) packet.
Executive ViewAI
The JXL 9-inch Car Android Double Din Player (Android v12.0) is vulnerable to a denial-of-service attack via malformed Bluetooth packets that crash the in-vehicle infotainment system without requiring pairing or user interaction. No vendor patch is currently available; while this is a niche automotive product with low exploitation probability (0.3% EPSS), organizations operating this hardware should assess exposure and implement interim controls to protect vehicle availability and user experience.
No vendor-released patch identified at time of analysis. Interim mitigations: disable Bluetooth when vehicle is unattended, establish Bluetooth-free zones or range controls in secure parking areas, and maintain staff awareness to report unexpected head unit restarts or Bluetooth connection failures.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB