CVE-2025-64342: ESP-IDF Denial of Service Vulnerability

CVE-2025-64342 Overview

CVE-2025-64342 affects the Espressif IoT Development Framework (ESP-IDF), the official development framework for ESP32 series System-on-Chip devices. When an ESP32 operates in Bluetooth Low Energy (BLE) advertising mode, it fails to properly validate the Access Address (AA) field in incoming connection requests. A connection request containing an invalid AA of 0x00000000 or 0xFFFFFFFF causes advertising to stop unexpectedly. The controller then incorrectly reports a connection event to the host, leading the application layer to assume a connection has been established when none exists. This mismatch between controller and host state is tracked under [CWE-754] (Improper Check for Unusual or Exceptional Conditions).

Critical Impact
A remote attacker within BLE radio range can force an advertising ESP32 device into an inconsistent state, disrupting availability and causing the host application to operate on a phantom connection.

Affected Products

Espressif ESP-IDF versions prior to 5.1.7
Espressif ESP-IDF versions prior to 5.2.6, 5.3.5, and 5.4.3
Espressif ESP-IDF versions prior to 5.5.2

Discovery Timeline

2025-11-17 - CVE-2025-64342 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-64342

Vulnerability Analysis

The vulnerability resides in the ESP32 Bluetooth LE controller's handling of inbound CONNECT_IND (connection request) Protocol Data Units. During advertising, a peripheral device expects a central to transmit a connection request containing a randomly generated 32-bit Access Address that will identify the resulting LE link layer connection. The Bluetooth Core Specification requires that this Access Address meet specific entropy and pattern constraints; addresses of all zeros or all ones violate those constraints.

The ESP32 controller accepts these malformed values without rejection. Advertising terminates, but the controller signals a successful connection completion event upstream to the host stack. The host, unaware of the underlying failure, transitions its state machine to the connected state.

Root Cause

The root cause is missing validation of the Access Address field in the connection request handler before advertising is halted and before the connection-complete event is dispatched. The controller does not check whether the AA meets the specification-mandated criteria, and it does not reconcile the halted advertising state with the reported connection outcome. This is an improper check for an exceptional condition classified under [CWE-754].

Attack Vector

An attacker within BLE radio range of a target ESP32 in advertising mode can transmit a crafted CONNECT_IND PDU containing an Access Address of 0x00000000 or 0xFFFFFFFF. The attack requires no authentication, no prior pairing, and no user interaction. The result is a denial-of-service condition against the advertising subsystem and a desynchronized state where the application layer believes a peer is connected but no valid link layer session exists. This can cause the device to stop accepting legitimate connections and may lead to further logic errors in higher-layer protocol handlers that trust the host-reported connection state.

No verified public proof-of-concept code is available. See the Espressif Security Advisory GHSA-8mg7-9qpg-p92v for additional technical context.

Detection Methods for CVE-2025-64342

Indicators of Compromise

ESP32 devices reporting connection events without corresponding legitimate peer traffic on the LE link.
Advertising unexpectedly terminating on an ESP32 peripheral without an explicit host-initiated stop command.
Application-layer session timers firing on connections that never exchanged L2CAP or ATT traffic.

Detection Strategies

Capture BLE traffic with a sniffer such as a Nordic nRF52 dongle or Ubertooth and filter for CONNECT_IND PDUs where the Access Address equals 0x00000000 or 0xFFFFFFFF.
Instrument firmware to log the raw Access Address value received in every connection request and alert on invalid values.
Correlate advertising-stop events with connection-complete events at the host controller interface (HCI) layer to identify mismatched state transitions.

Monitoring Recommendations

Track ESP-IDF version inventory across deployed IoT fleets and flag devices running versions below the fixed releases.
Monitor over-the-air update telemetry to confirm patched firmware reaches all field devices.
Log and review anomalous BLE connection lifecycle patterns from production ESP32 devices, especially connections that produce no application-layer traffic.

How to Mitigate CVE-2025-64342

Immediate Actions Required

Upgrade ESP-IDF to a fixed release: 5.5.2, 5.4.3, 5.3.5, 5.2.6, or 5.1.7. At publication, 5.5.2, 5.3.5, and 5.1.7 were not yet released, but the fixes are present in commits 3b95b50, e3d7042, and 75967b5.
Rebuild and reflash firmware for all affected ESP32 products in advertising roles.
Audit application-layer state machines to ensure they validate link activity before treating a connection as usable.

Patch Information

Espressif has committed fixes across multiple release branches. The relevant upstream commits are 309f031, 3b95b50, 75967b5, 8ec5410, bf66761, and e3d7042. The fixes add validation to reject connection requests with reserved or invalid Access Address values before halting the advertising state.

Workarounds

Where feasible, disable BLE advertising on ESP32 devices that do not require peripheral functionality until patched firmware is deployed.
Add an application-layer keepalive that verifies bidirectional traffic shortly after a reported connection and forces a link teardown and re-advertisement if no traffic arrives.
Restrict physical proximity or shield RF exposure of critical ESP32 deployments while patch rollout is in progress.

bash

# Update ESP-IDF to a fixed release branch and rebuild firmware
cd $IDF_PATH
git fetch origin
git checkout v5.4.3        # or v5.2.6, v5.5.2, v5.3.5, v5.1.7 when released
git submodule update --init --recursive
./install.sh
. ./export.sh
idf.py fullclean
idf.py build flash