CVE-2024-2104CWE-306

JBL: Improper BLE security configurations and lack of authentication on the device's GATT server

High · published December 10, 2025

CVSS v3.1
8.8
EPSS
0%
Percentile
13.8
In the wild
Unconfirmed
What it is

⚡ A flaw in Bluetooth security lets anyone nearby control your device without breaking a sweat! Just like an uninvited guest hijacking your smart home! Think of it as a poorly guarded party where anyone can walk in and mess with the playlist, changing the vibe without permission. In this case, the GATT server is like the DJ booth, and an attacker can take over the controls! An attacker could wreak havoc by issuing commands to your device, potentially rendering it useless! The consequences can be incredibly disruptive, affecting your daily life if they decide to turn off critical functions or mess with your settings.

Put simply

Think of it as a poorly guarded party where anyone can walk in and mess with the playlist, changing the vibe without permission. In this case, the GATT server is like the DJ booth, and an attacker can take over the controls! This vulnerability stems from improper security configurations on the device's Bluetooth Low Energy (BLE) GATT server, allowing adjacent unauthenticated attackers to read and write device control commands via the mobile app service.

What to do

An attacker could wreak havoc by issuing commands to your device, potentially rendering it useless! The consequences can be incredibly disruptive, affecting your daily life if they decide to turn off critical functions or mess with your settings. To fortify your defenses, ensure that BLE security configurations are properly set up and restrict access to authenticated users only. Regularly review device updates and implement security patches as they become available. You've got this! With the right steps, you can secure your devices and keep unwanted guests out! 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00236 · 13.8th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2025-12-10T12:56Z
EPSS history
Timeline
  • 10 DEC 12:56Z
    JBL: Improper BLE security configurations and lack of authentication on the device's GATT server
    cvelistv5