You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@mynewt.apache.org by Szymon Janc <ja...@apache.org> on 2026/01/08 09:54:32 UTC

CVE-2025-62235: Apache NimBLE: Incorrect handling of SMP Security Request could lead to undesirable pairing

Severity: important 

Affected versions:

- Apache NimBLE through 1.8.0

Description:

Authentication Bypass by Spoofing vulnerability in Apache NimBLE.

Receiving specially crafted Security Request could lead to removal of original bond and re-bond with impostor.
This issue affects Apache NimBLE: through 1.8.0.

Users are recommended to upgrade to version 1.9.0, which fixes the issue.

Credit:

Tommaso Sacchetti <to...@gmail.com> (reporter)

References:

https://github.com/apache/mynewt-nimble/commit/41f67e391e788c5feef9030026cc5cbc5431838a
https://mynewt.apache.org/
https://www.cve.org/CVERecord?id=CVE-2025-62235