EUVD-2026-36391
GHSA-62wc-8jj5-4mxm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLocate Bluetooth host running PcSuite
-
DeliveryApproach within radio range
-
ExploitInitiate Bluetooth connection to PcSuite service
-
ExecutionInvoke affected function without authentication
-
ImpactReceive leaked sensitive data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires Bluetooth radio range to a host running Vivo PcSuite at a version below 6.2.5 with Bluetooth enabled and the affected function reachable, per the CVSS 4.0 AV:A attack vector; no authentication (PR:N) and no user interaction (UI:N) are required and attack complexity is low (AC:L/AT:N). Exploitation is limited by physical proximity (typical Class 2 Bluetooth range, ~10 m), the need for PcSuite to be installed and running on a Windows host, and the requirement that Bluetooth be active on that host - it is not reachable across IP networks or the internet. |
| Impact | The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N) and 9.4 score signal a high-impact, low-complexity attack reachable over an adjacent (Bluetooth) network with no privileges or user interaction, and the vendor flags both confidentiality and integrity impact on the vulnerable system plus cascading impact on subsequent systems (SC:H/SI:H/SA:H), which is unusual for a flaw labelled only as information leakage and worth verifying with Vivo. There is no EPSS score, no CISA KEV listing, and no public POC referenced, so despite the headline score the real-world risk is currently bounded by the requirement for Bluetooth proximity and a target running a vulnerable PcSuite install. Treat this as a high-severity but proximity-gated issue: prioritise patching where PcSuite is deployed in shared, public, or office environments, but it is not on par with a remotely reachable internet-facing 9.x CVE. |
| Exploit ScenarioDerived | An attacker positioned within roughly 10 meters of a target laptop or PC running a vulnerable Vivo PcSuite establishes a Bluetooth connection and invokes the affected function without completing the expected authentication, causing PcSuite to return sensitive data from the host or paired phone. Because AC:L/PR:N/UI:N applies, this can be scripted against any reachable victim in a coffee shop, office lobby, or commuter setting without tricking the user into clicking anything. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 12, 2026
Information disclosure in Vivo PcSuite versions below 6.2.5 allows adjacent attackers within Bluetooth range to bypass an authentication mechanism in a specific function and obtain sensitive data without user interaction. The flaw is tracked as a missing-authentication weakness (CWE-306) reported directly by Vivo and carries a CVSS 4.0 score of 9.4, with no public exploit identified at time of analysis.
Earlier versions of this analysis (2)
Authentication bypass in Vivo PcSuite versions below 6.2.5 allows an adjacent attacker within Bluetooth range to access a function whose authentication mechanism is defective, resulting in information leakage from the paired device. The flaw is classified as CWE-306 (Missing Authentication for Critical Function) and was reported by the vendor itself; no public exploit identified at time of analysis. The CVSS 4.0 score of 9.4 reflects high impact on both the vulnerable and subsequent systems, though exploitation requires proximity rather than internet reach.
Information disclosure in Vivo PcSuite allows adjacent attackers within Bluetooth range to bypass a missing authentication check on a specific function and read sensitive data from a paired or discoverable device. The CVSS 4.0 score of 8.7 (High) reflects high confidentiality and integrity impact over an adjacent network vector with no privileges or user interaction required, and no public exploit identified at time of analysis.
RemediationAI
Upgrade Vivo PcSuite to version 6.2.5 or later as documented in the vendor advisory at https://www.vivo.com/en/support/security-advisory-detail?id=22, since this is the only confirmed fix. Until the upgrade can be deployed, reduce exposure by disabling Bluetooth on hosts running PcSuite when it is not actively in use, unpairing untrusted devices, and avoiding running PcSuite in untrusted RF environments such as conferences, cafes, and open-plan public spaces; note the trade-off that disabling Bluetooth breaks legitimate phone synchronization. Restricting Bluetooth discoverability and using OS-level Bluetooth allowlists where supported further narrows the attacker pool without disabling functionality entirely.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Vivo PcSuite is the desktop companion application Vivo ships for managing its Android smartphones, handling device synchronization, backups, and data transfer over USB and Bluetooth pairings. The root cause is CWE-306 (Missing Authentication for Critical Function): a function exposed over the Bluetooth transport does not adequately verify the identity of the requesting peer, so any device within wireless range that can establish or piggyback on a Bluetooth connection can reach functionality that should require an authenticated, paired session. The CPE cpe:2.3:a:vivo:pcsuite:*:*:*:*:*:*:*:* indicates the flaw spans all builds of the PcSuite application prior to the fixed 6.2.5 release rather than being tied to a specific phone firmware.
Know when Pcsuite gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H
Bluetooth-range adjacent vector with no auth or user interaction; vendor flags both confidentiality and integrity impact while availability is unaffected, so PR:N, UI:N, C:H, I:H, A:N.
Primary rating from Vendor (Vivo).
CVSS VectorVendor: Vivo
Lifecycle Timeline
4DescriptionCVE.org
The authentication mechanism of a certain function in the PcSuite has a defect, which may result in information leakage within the range of a Bluetooth connection.
Executive ViewAI
Vivo PcSuite versions below 6.2.5 contain a critical authentication bypass (CVE-2026-11535, CVSS 9.4) allowing unauthenticated attackers within Bluetooth range to extract sensitive user data without user interaction. No public exploit identified at time of analysis. Organizations relying on Vivo PcSuite across their workforce face elevated data breach risk from proximity-based attacks.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable Bluetooth on affected systems when not in use; (2) Restrict Bluetooth discovery and pairing via endpoint policy; (3) Implement network segmentation isolating Vivo PcSuite systems from sensitive data stores; (4) Deploy encryption for sensitive data processed by Vivo PcSuite; (5) Monitor Bluetooth connection logs and pairing attempts for unauthorized access.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB