CVE-2025-9994: Amp'ed RF BT-AP 111 Auth Bypass Flaw

CVE-2025-9994 Overview

The Amp'ed RF BT-AP 111 Bluetooth access point contains a critical authentication bypass vulnerability in its HTTP admin interface. The device lacks any authentication mechanism, allowing unauthorized access to anyone with network connectivity to the device. This missing authentication feature (CWE-287) enables attackers to gain complete administrative control over the Bluetooth access point without providing credentials.

Critical Impact

Attackers with network access can fully compromise the BT-AP 111 device without credentials, potentially gaining unauthorized control over Bluetooth network infrastructure, modifying configurations, and intercepting Bluetooth traffic.

Affected Products

• Amp'ed RF BT-AP 111 Bluetooth Access Point

Discovery Timeline

• September 9, 2025 - CVE-2025-9994 published to NVD
• November 3, 2025 - Last updated in NVD database

Technical Details for CVE-2025-9994

Vulnerability Analysis

This vulnerability represents a fundamental security design flaw in the Amp'ed RF BT-AP 111 Bluetooth access point. The device's HTTP administrative interface is accessible without any form of authentication, effectively leaving the management plane completely exposed to anyone who can reach the device over the network.

The vulnerability is classified under CWE-287 (Improper Authentication), indicating that the device fails to prove that a user has claimed an identity. In this case, the HTTP admin interface simply does not implement any authentication mechanism whatsoever, meaning no username, password, or other credential verification occurs before granting administrative access.

Root Cause

The root cause of this vulnerability is the complete absence of authentication controls on the HTTP admin interface. The device was designed or configured without implementing any identity verification for administrative functions. This represents a significant oversight in the device's security architecture, as administrative interfaces typically require authentication to prevent unauthorized access.

Attack Vector

An attacker can exploit this vulnerability by simply connecting to the BT-AP 111 device's HTTP admin interface over the network. No credentials, exploitation techniques, or specialized tools are required. The attack can be executed by:

1. Identifying a BT-AP 111 device on the network through scanning or reconnaissance
2. Navigating to the device's HTTP admin interface via a web browser
3. Gaining immediate, unauthenticated administrative access to all device functions

The network-based attack vector with no authentication requirements makes this vulnerability trivially exploitable by any attacker with network access to the device.

Detection Methods for CVE-2025-9994

Indicators of Compromise

• Unexpected configuration changes on BT-AP 111 devices
• Unknown or unauthorized HTTP connections to the device's admin interface
• Modified Bluetooth pairing or access settings
• Unusual network traffic patterns to/from the access point

Detection Strategies

• Monitor network traffic for HTTP connections to BT-AP 111 devices from unexpected sources
• Implement network segmentation to isolate Bluetooth access points and log all access attempts
• Deploy network intrusion detection systems (NIDS) to identify unauthorized access to IoT device management interfaces
• Conduct regular configuration audits to detect unauthorized changes

Monitoring Recommendations

• Enable logging on network devices to capture all connections to the BT-AP 111 admin interface
• Implement alerting for any administrative access to IoT and network infrastructure devices
• Monitor for port scanning activity targeting HTTP services on embedded devices
• Review firewall logs for connections to the device from untrusted network segments

How to Mitigate CVE-2025-9994

Immediate Actions Required

• Place BT-AP 111 devices behind a firewall that restricts access to the HTTP admin interface
• Implement network segmentation to isolate the device from untrusted networks
• Use a VPN or dedicated management network for accessing the device's admin interface
• Consider taking the device offline until a security patch is available

Patch Information

No vendor patch information is currently available for this vulnerability. Organizations should contact Amp'ed RF Tech directly for information about firmware updates. For additional technical details, refer to the Amped RF Tech User Manual and the CERT Vulnerability Note VU#763183.

Workarounds

• Deploy network access controls (ACLs) to restrict HTTP access to the device to trusted IP addresses only
• Place the device on an isolated VLAN with strict ingress filtering
• Use a reverse proxy with authentication in front of the device's admin interface
• Monitor and log all network access to the device for forensic purposes

# Example firewall rule to restrict access to BT-AP 111 admin interface
# Replace <BT-AP-111-IP> with the device IP and <ADMIN-WORKSTATION-IP> with trusted admin IPs
iptables -A FORWARD -d <BT-AP-111-IP> -p tcp --dport 80 -s <ADMIN-WORKSTATION-IP> -j ACCEPT
iptables -A FORWARD -d <BT-AP-111-IP> -p tcp --dport 80 -j DROP