CVE-2025-4994: SafeLine SL6 Auth Bypass Vulnerability

CVE-2025-4994 Overview

CVE-2025-4994 is an authentication bypass vulnerability in SafeLine SL6 and SL6+ devices used in elevator emergency intercom systems. The flaw allows an attacker within Bluetooth Low Energy (BLE) wireless range to access the device's configuration service without providing valid credentials. Successful exploitation grants unauthorized administrative access to the device configuration. The weakness maps to CWE-305: Authentication Bypass by Primary Weakness.

Critical Impact
An attacker in BLE radio range can take administrative control of elevator emergency intercoms, manipulate configuration, and disrupt a life-safety communication channel.

Affected Products

SafeLine SL6 elevator emergency intercom device
SafeLine SL6+ elevator emergency intercom device
Elevator installations integrating SL6/SL6+ over the BLE configuration interface

Discovery Timeline

2026-06-22 - CVE-2025-4994 published to NVD
2026-06-22 - Last updated in NVD database
Public technical analysis available via the Schutzwerk Blog Analysis

Technical Details for CVE-2025-4994

Vulnerability Analysis

The SL6 and SL6+ devices expose a configuration service over Bluetooth Low Energy. The service is intended to be restricted to authenticated administrators using the vendor's mobile application. The implementation fails to enforce authentication on the BLE Generic Attribute Profile (GATT) characteristics that handle configuration commands. An adjacent attacker can therefore connect to the device and issue privileged operations directly.

Because the intercom is part of an elevator emergency communication path, configuration tampering has safety implications. An attacker can alter dialing destinations, audio settings, and SIM-related parameters, or disable the emergency call function entirely. The attack requires only BLE radio proximity, with no user interaction and no prior credentials.

Root Cause

The root cause is missing authentication on a primary channel [CWE-305]. The BLE configuration service trusts any peer that completes a standard GATT connection. There is no challenge-response, pairing-based key verification, or application-layer credential check before configuration writes are accepted.

Attack Vector

The attack vector is adjacent network access over BLE. An attacker positioned within radio range of the elevator car or machine room scans for the SL6/SL6+ advertisement, initiates a GATT connection, and writes to the configuration characteristics. No pairing prompt, PIN, or shared secret is required. Refer to the Schutzwerk Blog Analysis for protocol-level details and proof-of-concept methodology.

// No verified exploit code is published.
// Conceptual flow:
//   1. BLE scan for SafeLine SL6/SL6+ advertisement
//   2. GATT connect (no pairing required)
//   3. Write to configuration characteristic UUID
//   4. Device accepts privileged command without authentication

Detection Methods for CVE-2025-4994

Indicators of Compromise

Unexpected BLE GATT connections to SL6/SL6+ devices logged by on-site Bluetooth monitors.
Configuration changes on the intercom that do not correspond to a scheduled maintenance ticket.
Modified emergency call numbers, altered SIP or GSM settings, or disabled emergency dial-out routines.
Presence of unknown BLE client MAC addresses in proximity to elevator equipment.

Detection Strategies

Deploy Bluetooth spectrum monitoring in elevator machine rooms and cars to flag unauthorized BLE pairing or GATT writes.
Periodically export the SL6/SL6+ configuration and diff against a known-good baseline to catch unauthorized changes.
Correlate physical access logs for elevator shafts and machine rooms with any observed BLE activity windows.

Monitoring Recommendations

Alert on configuration writes occurring outside approved maintenance windows.
Track failed and successful emergency test calls to detect silent disablement of the intercom.
Forward device event logs, where supported, into a centralized SIEM or data lake for retention and correlation.

How to Mitigate CVE-2025-4994

Immediate Actions Required

Contact SafeLine and the elevator service provider to confirm firmware status and obtain a patched build for SL6 and SL6+.
Inventory all elevator installations using SL6/SL6+ and prioritize remediation in high-occupancy or critical-infrastructure buildings.
Audit current device configurations against documented baselines and restore any unauthorized changes.
Restrict physical access to elevator machine rooms and shafts to limit BLE proximity attacks.

Patch Information

At the time of NVD publication on 2026-06-22, no vendor advisory URL is referenced in the CVE record. Operators should request a fixed firmware version directly from SafeLine and consult the Schutzwerk Blog Analysis for the latest disclosure status.

Workarounds

Disable the BLE configuration interface on SL6/SL6+ devices where the feature is not required for ongoing maintenance.
Power down the BLE radio between scheduled service visits if the device firmware exposes that option.
Use RF shielding or physical enclosure controls to reduce BLE signal leakage outside the elevator equipment area.
Schedule maintenance via wired or vendor-supported authenticated channels instead of BLE where feasible.

bash

# Operational baseline check (pseudocode - run from authorized maintenance app)
# 1. Export current SL6/SL6+ configuration
safeline-cli export-config --device <serial> --out current.cfg

# 2. Diff against approved baseline
diff baseline.cfg current.cfg

# 3. Re-flash latest vendor firmware once available
safeline-cli firmware-update --device <serial> --image SL6_fixed.bin