CVE-2025-47370: Qualcomm AR8035 Firmware DOS Vulnerability

CVE-2025-47370 Overview

CVE-2025-47370 is a transient denial-of-service (DoS) vulnerability affecting a broad range of Qualcomm chipsets and firmware. The flaw resides in the Bluetooth stack and triggers when a remote device sends an invalid connection request while the target is performing a Bluetooth connectable Low Energy (LE) scan. The weakness is tracked under CWE-617: Reachable Assertion and is exploitable over an adjacent network, meaning an attacker must be within Bluetooth radio range. Qualcomm addressed the issue in its November 2025 security bulletin.

Critical Impact
An unauthenticated attacker within Bluetooth range can trigger a transient DoS condition on affected Qualcomm Bluetooth-enabled devices by sending a malformed LE connection request, disrupting Bluetooth availability on mobile, automotive, compute, and IoT platforms.

Affected Products

Qualcomm FastConnect 6700, 6900, and 7800 Wi-Fi and Bluetooth subsystems
Qualcomm Snapdragon 8 Gen 2, 8+ Gen 2, and 8 Gen 3 Mobile Platforms, plus Snapdragon 778G/782G/7c+ Gen 3 Compute
Qualcomm Snapdragon Auto 4G/5G Modem-RF families, SA8155/SA8255P/SA8295P automotive SoCs, and QCA Wi-Fi/Bluetooth combo chipsets (QCA6391, QCA6574, QCA6696, QCA6698AQ and related variants)

Discovery Timeline

2025-11-04 - CVE-2025-47370 published to NVD
November 2025 - Qualcomm releases security patch in the November 2025 Security Bulletin
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47370

Vulnerability Analysis

The vulnerability lives in the Qualcomm Bluetooth controller firmware path that handles incoming LE connection requests. When the device is actively performing a connectable LE scan, it listens for advertising packets and processes inbound CONNECT_IND PDUs from peer devices. A malformed or structurally invalid connection request reaches a code path that includes a reachable assertion, classified as [CWE-617]. When the assertion triggers, the Bluetooth subsystem aborts the current operation and the Bluetooth stack becomes unavailable until it recovers or the device is restarted.

Because the Bluetooth link layer runs inside tightly coupled firmware on the Qualcomm connectivity SoC, a crash in this component can cascade into related subsystems that depend on the connectivity hardware, such as audio routing to Bluetooth peripherals, car infotainment pairing, and wearable sync. No code execution occurs, and confidentiality and integrity are not impacted; the exposure is strictly availability.

Root Cause

The root cause is improper input validation of inbound LE connection request fields during an active connectable scan. The firmware encounters an unexpected state and reaches an assertion that was intended as a developer safety net rather than a runtime-recoverable error path. No authentication or pairing is required because advertising and scanning occur before any link-layer security is established.

Attack Vector

Exploitation requires the attacker to be within Bluetooth radio range of a target device that has Bluetooth enabled and is performing a connectable LE scan. Many Android smartphones, automotive head units, Snapdragon-based laptops, and IoT devices perform connectable LE scans by default when Bluetooth is on. The attacker transmits a crafted invalid LE connection request addressed to the victim. The target firmware processes the request, hits the reachable assertion, and the Bluetooth stack enters a transient DoS state. The attack can typically be repeated to sustain the outage.

No proof-of-concept code is publicly available in the enriched dataset for CVE-2025-47370.

Detection Methods for CVE-2025-47370

Indicators of Compromise

Repeated unexpected Bluetooth stack restarts, bluetoothd crashes, or kernel log entries referencing Qualcomm Bluetooth HCI resets on affected devices
Sudden loss of Bluetooth connectivity to paired peripherals (headsets, car kits, wearables) correlated with the presence of unknown nearby Bluetooth devices
HCI command/event logs showing malformed LE CONNECT_IND packets or link-layer errors immediately preceding a controller reset

Detection Strategies

Collect and centralize mobile and endpoint telemetry (Android logcat, Windows event logs, Linux dmesg and journald) and alert on recurring Bluetooth controller resets tied to Qualcomm driver tags
For fleet-managed Android and Snapdragon compute devices, use MDM compliance checks to confirm the November 2025 (or later) Qualcomm security patch level is applied
In automotive and OT environments, monitor in-vehicle network diagnostics for repeated Bluetooth module reinitialization that correlates with proximity events

Monitoring Recommendations

Baseline the normal rate of Bluetooth stack restarts per device class and alert on statistically significant spikes
Where supported, enable Bluetooth HCI snoop logging on test devices in sensitive environments to help triage suspected radio-proximity DoS incidents
Track Qualcomm security bulletin releases and correlate vendor patch availability against your device inventory on a monthly cadence

How to Mitigate CVE-2025-47370

Immediate Actions Required

Inventory devices built on the Qualcomm chipsets listed in the bulletin, including Snapdragon mobile, compute, automotive, and FastConnect/QCA connectivity components
Apply the November 2025 Qualcomm security patch as soon as it is delivered by the OEM or carrier for each affected device
In high-sensitivity environments, disable Bluetooth on devices that do not require it until patches are deployed

Patch Information

Qualcomm has issued fixes as part of the Qualcomm November 2025 Security Bulletin. Patches are distributed to OEMs who incorporate them into device firmware and operating system updates. End-user remediation depends on OEM and carrier delivery schedules, so confirm the Qualcomm security patch level on each device after updating.

Workarounds

Turn off Bluetooth on affected devices when not in use, particularly in public or untrusted RF environments
Avoid leaving devices in connectable/discoverable LE scan mode longer than necessary
For automotive and fixed IoT deployments where disabling Bluetooth is not feasible, restrict physical proximity access and monitor for repeated controller resets as an operational signal