CVE-2025-9994CWE-287CWE-306

CVE-2025-9994

Critical · published September 9, 2025

CVSS v3.1
9.8
EPSS
1%
Percentile
43.7
In the wild
Unconfirmed
What it is

⚡ The Amp’ed RF BT-AP 111's admin interface is completely open—no password needed! That's like leaving the front door wide open at your tech party, inviting anyone in. 🔥 Think of this access point as a trendy café without a lock on the door. Anyone with Wi-Fi access can just stroll in and start brewing trouble, no security checks required! The consequences could be absolutely devastating. An attacker could seize control of the device, potentially intercepting sensitive data or launching attacks against other devices on the network. With full access, they could even change configurations or disrupt services, turning your reliable access point into a vulnerability!

Put simply

Think of this access point as a trendy café without a lock on the door. Anyone with Wi-Fi access can just stroll in and start brewing trouble, no security checks required! This vulnerability arises from the absence of an authentication feature in the HTTP admin interface, allowing any network user to access the settings without any form of verification, making it a prime target for unauthorized intrusion.

What to do

The consequences could be absolutely devastating. An attacker could seize control of the device, potentially intercepting sensitive data or launching attacks against other devices on the network. With full access, they could even change configurations or disrupt services, turning your reliable access point into a vulnerability! To protect your network, patch the device firmware immediately and implement network segmentation to limit access to the admin interface. Regularly review configurations and ensure that sensitive devices are behind firewalls or additional security measures. You've got this! By taking these steps, you're not just fixing a flaw—you're stepping up as a security hero! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00525 · 43.7th percentile
Weaknesses
CWE-287 · Improper Authentication; CWE-306 · Missing Authentication for Critical Function
Published
2025-09-09T18:15Z
References (2)
EPSS history
Timeline
  • 09 SEP 13:01Z
    Amp’ed RF BT-AP 111 Bluetooth access point's HTTP admin interface does not require authentication
    cvelistv5