CVE-2024-2104 - JBL: Improper BLE security configurations and lack of authentication on the device's GATT server

Back Back to CVE browser

HIGH

JBL: Improper BLE security configurations and lack of authentication on the device's GATT server

Published Dec 10, 2025

8.8

HIGH

CVSS 3.1

EPSS 0.24%

Description

Due to improper BLE security configurations on the device's GATT server, an adjacent unauthenticated attacker can read and write device control commands through the mobile app service wich could render the device unusable.

Affected products

Vendor JBL Product Live Pro 2 Tws Default
unaffected
Vendor JBL Product Tune Flex Default
unaffected

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

JBL

Live Pro 2 Tws

unaffected

Version	Status	Constraints

JBL

Tune Flex

unaffected

Version	Status	Constraints

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-306

Missing Authentication

References (3)

https://certvde.com/en/advisories/VDE-2024-076
vendor-advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-27068
Advisory
https://harman.csaf-tp.certvde.com/.well-known/csaf/white/2025/hbsa-2025-0001.json
vendor-advisory

Link	Providers	Tags
https://certvde.com/en/advisories/VDE-2024-076		vendor-advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-27068		Advisory
https://harman.csaf-tp.certvde.com/.well-known/csaf/white/2025/hbsa-2025-0001.json		vendor-advisory