CVE-2025-44557 - A state machine transition flaw in the Bluetooth Low Energy (BLE) stack of Cypress PSoC4 v3.66 allows attackers to bypass the pairing process and authentication via a crafted pairing_failed packet

Back Back to CVE browser

HIGH

A state machine transition flaw in the Bluetooth Low Energy (BLE) stack of Cypress PSoC4 v3.66 allows attackers to bypass the pairing process and authentication via a crafted pairing_failed packet

Published Jun 27, 2025

8.1

HIGH

CVSS 3.1

EPSS 0.28%

Description

A state machine transition flaw in the Bluetooth Low Energy (BLE) stack of Cypress PSoC4 v3.66 allows attackers to bypass the pairing process and authentication via a crafted pairing_failed packet.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-303

References (3)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-19417		Advisory
https://github.com/yangting111/BLE_TEST/blob/main/result/PoC/Cypress/Auth_bypass.md
https://www.infineon.com/cms/en/design-support/tools/sdk/psoc-software/psoc-4-components/psoc-creator-component-datasheet-bluetooth-low-energy-ble/

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Jun 27, 2025

Updated Jul 2, 2025

Reserved Apr 22, 2025

Link CVE-2025-44557

CISA Vulnrichment

Updated Jul 2, 2025

NVD

Status Deferred

Modified Jun 17, 2026

Link CVE-2025-44557

Red Hat

No data

ENISA EUVD

Assigner mitre

Published Jun 27, 2025

Updated Jul 2, 2025

Link EUVD-2025-19417

GitHub

No data