What is the CVSS score of CVE-2026-31280?

CVE-2026-31280 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Parani M10 Motorcycle Intercom CVE-2026-31280

EUVD-2026-22071 MEDIUM

Classic Buffer Overflow (CWE-120)

2026-04-13 mitre

Buffer Overflow Denial Of Service N A

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

May 10, 2026 - 21:22 vuln.today

CVSS changed

May 10, 2026 - 21:22 NVD

6.5 (MEDIUM)

EUVD ID Assigned

Apr 13, 2026 - 21:00 euvd

EUVD-2026-22071

CVE Published

Apr 13, 2026 - 00:00 nvd

N/A

CVE Published

Apr 13, 2026 - 00:00 nvd

MEDIUM 6.5

DescriptionCVE.org

An issue in the Bluetooth RFCOMM service of Parani M10 Motorcycle Intercom v2.1.3 allows unauthorized attackers to cause a Denial of Service (DoS) via supplying crafted RFCOMM frames.

Articles & Coverage 1

medium.com CVE-2026-31280: Parani M10 Intercom Bluetooth RFCOMM DoS Vulnerability Apr 10, 2026

AnalysisAI

Denial of service in Parani M10 Motorcycle Intercom v2.1.3 via crafted Bluetooth RFCOMM frames allows unauthenticated attackers within wireless range to crash the device. The vulnerability exploits a buffer overflow in the RFCOMM service handler, causing high availability impact. A proof-of-concept exists but active exploitation has not been confirmed; EPSS score of 0.02% suggests limited real-world exploitation pressure despite the accessible attack vector.

Technical ContextAI

The Bluetooth RFCOMM (Radio Frequency Communication) protocol is a serial port emulation service layered atop the Bluetooth L2CAP protocol, commonly used in hands-free audio devices and intercoms for command and control channels. The Parani M10 implements RFCOMM to handle wireless communication between multiple intercom units. The vulnerability stems from CWE-120 (Buffer Copy without Checking Size of Input-'classic' buffer overflow), indicating that the RFCOMM frame parser does not properly validate the length of incoming frames before copying them into a fixed-size buffer. Malformed RFCOMM frames with oversized payloads trigger memory corruption, leading to device crash. The attack requires no authentication (CVSS PR:N) and no user interaction (UI:N), making exploitation straightforward for any attacker within Bluetooth range (AV:A-adjacent network).

RemediationAI

Contact Parani/Amoebatech for a patched firmware version; the CVE description and available references do not specify an exact fixed version number, preventing a definitive upgrade path from this analysis. Until a patch is available, mitigation relies on operational controls: disable or restrict Bluetooth RFCOMM services if not required for core intercom function (trade-off: loss of remote command capability or pairing flexibility), disable Bluetooth entirely in low-threat environments (trade-off: intercom becomes wired-only), or maintain physical isolation of intercom units from untrusted Bluetooth environments (trade-off: reduced mobility and multi-unit coordination). For motorcycle riders, recommend avoiding public or crowded venues where rogue Bluetooth attackers could operate. Monitor Amoebatech security advisories and VulDB/NVD for patch availability; subscribe to vendor security notifications if available. If a patched firmware version is released, apply it immediately via over-the-air update (if supported) or device firmware flash.