CVE-2025-3885: Samsung Harman MGU21 Bluetooth DOS Vulnerability

CVE-2025-3885 Overview

CVE-2025-3885 is an improper input validation vulnerability in the Bluetooth stack of the Broadcom BCM89359 chipset used in Harman Becker MGU21 infotainment devices. Network-adjacent attackers can trigger a denial-of-service condition by transmitting malformed Bluetooth frames to affected units. Exploitation requires no authentication and no user interaction. The flaw was disclosed through the Zero Day Initiative under identifier ZDI-CAN-23942. The vulnerability is tracked under [CWE-20: Improper Input Validation].

Critical Impact
An attacker within Bluetooth range can crash the MGU21 head unit, disrupting in-vehicle infotainment availability without any prior pairing or user consent.

Affected Products

Samsung Harman MGU21 firmware version mgu21_22-07
Samsung Harman MGU21 hardware (all revisions running affected firmware)
Systems integrating the Broadcom BCM89359 Bluetooth chipset as configured in MGU21

Discovery Timeline

2025-05-22 - CVE-2025-3885 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-3885

Vulnerability Analysis

The vulnerability resides in the Bluetooth stack running on the BCM89359 chipset integrated in the Harman Becker MGU21 platform. The stack fails to properly validate the structure or contents of incoming Bluetooth frames before processing them. When a malformed frame reaches the parser, the resulting error condition causes the Bluetooth subsystem or the wider infotainment unit to enter an unrecoverable state.

Because the attack targets protocol-level parsing, no pairing, bonding, or authentication is required. An attacker only needs to be within Bluetooth radio range of the target vehicle, consistent with the adjacent-network attack surface described in the Zero Day Initiative advisory ZDI-25-251.

Root Cause

The root cause is missing or insufficient validation of Bluetooth frame fields inside the chipset firmware. The parser accepts input that violates expected size, type, or state assumptions and dereferences or processes it as if it were well-formed. This category of defect is classified as [CWE-20], improper input validation, and typically leads to memory corruption, invalid state transitions, or watchdog-triggered resets in embedded stacks.

Attack Vector

Exploitation occurs over the Bluetooth radio interface, which places the attacker on the adjacent network of the target device. A crafted Bluetooth frame is transmitted to the MGU21 head unit; the vulnerable code path is reached during frame reception and parsing. Successful exploitation degrades or halts the Bluetooth service and can propagate to a full denial of service on the infotainment system, impacting hands-free calling, media streaming, and connected navigation features.

No verified public proof-of-concept is available at the time of publication. Refer to the Zero Day Initiative Advisory ZDI-25-251 for further technical context.

Detection Methods for CVE-2025-3885

Indicators of Compromise

Unexpected reboots or hangs of the MGU21 head unit while Bluetooth is enabled and discoverable.
Repeated Bluetooth service crashes or loss of previously paired device connectivity.
Diagnostic trouble codes (DTCs) or vendor telemetry entries referencing the Bluetooth subsystem on the BCM89359 chipset.

Detection Strategies

Monitor vehicle telematics and infotainment logs for abnormal Bluetooth stack resets or watchdog events correlated with proximity of unknown devices.
Use Bluetooth spectrum monitoring at service centers and fleet depots to detect anomalous inquiry, advertising, or malformed L2CAP traffic aimed at parked vehicles.
Correlate customer complaint patterns describing repeatable head-unit crashes when specific external devices are in range.

Monitoring Recommendations

Enable and retain OEM diagnostic logs from the infotainment ECU where supported, and review Bluetooth-related fault codes during service intervals.
For fleet operators, aggregate infotainment fault telemetry centrally and alert on clusters of Bluetooth-driven resets across multiple vehicles.
Track vendor advisories from Samsung Harman and Broadcom for firmware updates addressing the BCM89359 Bluetooth stack.

How to Mitigate CVE-2025-3885

Immediate Actions Required

Apply the latest MGU21 firmware update from Samsung Harman as soon as it is made available through the vehicle manufacturer's service channel.
Advise drivers to disable Bluetooth on the MGU21 head unit when it is not actively required, especially in high-density public environments.
Set the head unit to non-discoverable mode and remove unused paired devices to reduce exposure to opportunistic scanning.

Patch Information

At publication, the NVD entry references firmware version mgu21_22-07 as affected. No fixed firmware version is listed in the referenced ZDI-25-251 advisory. Vehicle owners and fleet operators should contact their OEM or authorized service provider to confirm the availability of a corrective firmware release for the MGU21 platform and the underlying BCM89359 Bluetooth stack.

Workarounds

Disable Bluetooth on the MGU21 head unit until vendor-supplied firmware addressing CVE-2025-3885 is installed.
Keep the infotainment system in non-discoverable mode and avoid initiating new pairings in untrusted locations.
Restrict the number of paired devices to known, trusted endpoints to limit incidental exposure to malformed frames.

bash

# Configuration example
# On the MGU21 head unit, from the Bluetooth settings menu:
#   1. Set Bluetooth: OFF
#   2. Set Visibility / Discoverable: OFF
#   3. Remove unused paired devices from the device list
# Re-enable Bluetooth only after applying the OEM firmware update addressing CVE-2025-3885.