What is the CVSS score of EUVD-2026-23270?

EUVD-2026-23270 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

N A EUVD-2026-23270

| CVE-2026-37100 MEDIUM

Improper Access Control (CWE-284)

2026-04-16 mitre

GHSA-c9qp-qc83-7rwj

Authentication Bypass N A

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 18, 2026 - 04:22 vuln.today

CVSS changed

Apr 18, 2026 - 04:22 NVD

6.5 (MEDIUM)

EUVD ID Assigned

Apr 16, 2026 - 16:00 euvd

EUVD-2026-23270

Analysis Generated

Apr 16, 2026 - 16:00 vuln.today

CVE Published

Apr 16, 2026 - 00:00 nvd

MEDIUM 6.5

DescriptionCVE.org

An issue in the Bluetooth Low Energy (BLE) control interface of the Yamaha SR-B30A sound bar firmware 2.40 (Mobile App: Sound Bar Remote / version: 2.40) allows remote attackers within BLE radio range to connect without authentication via the Sound Bar Remote protocol

AnalysisAI

Yamaha SR-B30A sound bar firmware 2.40 allows remote attackers within Bluetooth Low Energy (BLE) radio range to connect to the device and modify settings without authentication via the Sound Bar Remote protocol. The vulnerability enables unauthenticated integrity compromise (modification of device configuration) but does not expose sensitive data or cause denial of service. This affects only devices within BLE proximity range, significantly limiting practical attack scope despite the moderate CVSS score.

Technical ContextAI

The vulnerability resides in the Bluetooth Low Energy (BLE) control interface of the Yamaha SR-B30A sound bar, which implements the Sound Bar Remote protocol for wireless control via mobile applications and nearby devices. BLE is a wireless communication standard designed for low-power personal area networks operating on the 2.4 GHz ISM band with a typical range of 10-100 meters depending on environment and antenna configuration. The affected firmware version 2.40 fails to implement proper authentication mechanisms on the BLE control channel, violating CWE-284 (Improper Access Control) by allowing any device within BLE radio range to establish a connection and issue commands. The root cause is the absence of cryptographic authentication or device pairing validation before accepting control commands through the BLE protocol stack.

RemediationAI

Yamaha users should upgrade the SR-B30A sound bar firmware to a version newer than 2.40 when available from Yamaha's support portal or through the Sound Bar Remote application's built-in firmware update feature. Consult Yamaha's official advisory and firmware release notes at https://www.yamaha.com/en/support/ for the specific patched version number and update procedure. As an interim compensating control, users can limit exposure by disabling the Bluetooth Low Energy control interface entirely if alternative control methods (infrared remote, wired control) are available, though this eliminates remote control functionality. Additionally, deploy sound bars in network environments with physical access controls (locked rooms, restricted areas) to reduce the likelihood of proximity-based attacks. If the device supports BLE pairing or bonding features, explicitly enable and configure mandatory device bonding to prevent unauthenticated connections, verifying this setting in the device's Bluetooth settings menu.