EUVD-2025-210213Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Bluetooth context implies adjacent-network vector; logic error exploitation likely requires specific device state, raising AC to H; no integrity or availability impact.
Primary rating from CISA-ADP.
CVSS VectorCISA-ADP
Lifecycle Timeline
3DescriptionCVE.org
In multiple functions of btm_sec.cc, there is a possible way for an attacker to intercept SMS messages due to a logic error in the code. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.
AnalysisAI
SMS interception is possible on Android 17 via a logic error in the Bluetooth Security Manager (btm_sec.cc), allowing a remote attacker to disclose private SMS message content without requiring elevated privileges. The flaw stems from a protection mechanism failure (CWE-693) in the Bluetooth stack's security logic, enabling an attacker to bypass expected access controls on message content. No public exploit code has been identified and CISA has not added this to the Known Exploited Vulnerabilities catalog, but the privacy implications for targeted users are notable given the sensitivity of SMS data (OTPs, 2FA codes, personal communications).
Technical ContextAI
The vulnerability resides in btm_sec.cc, the Bluetooth Security Manager module within Android's Bluetooth stack (Fluoride/BlueDroid). This file handles security-critical operations including Bluetooth pairing, authentication, and access control enforcement between paired devices. CWE-693 (Protection Mechanism Failure) indicates the root cause is not a memory corruption or injection flaw but rather a logic error where a security guard or access check is bypassed or incorrectly implemented - a condition check that should block unauthorized access to SMS data either fires in the wrong order, evaluates incorrect state, or can be short-circuited by crafted Bluetooth interactions. The affected CPE is cpe:2.3:a:google:android:*:*:*:*:*:*:*:*, and per EUVD-2025-210213, the affected version is Android 17. The CVSS vector is rated AV:N by Google, which warrants scrutiny given the Bluetooth context - Bluetooth typically implies adjacent-network proximity rather than arbitrary internet exploitation.
RemediationAI
Apply the Android security patch released in the Android 17 security bulletin available at https://source.android.com/docs/security/bulletin/android-17. Device manufacturers (OEMs) must incorporate this patch into their own updates; end-users should apply the latest monthly Android security patch level from their device's OEM as soon as it becomes available. The exact patched build version is not independently confirmed from the available references beyond the bulletin pointer. As an interim compensating control, disabling Bluetooth when not actively in use eliminates the attack surface - this has no impact on cellular SMS reception but does disable Bluetooth-dependent features such as audio devices and file transfer. Users handling high-sensitivity SMS content (e.g., OTP codes for privileged accounts) should additionally consider switching to authenticator app-based 2FA where possible, reducing the value of intercepted SMS. No workaround short of disabling Bluetooth is known to address the underlying logic error.
Same weakness CWE-693 – Protection Mechanism Failure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today