CVE-2025-52435
Apache Nimble ≤ 1.9.0
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NSummary
CVE-2025-52435 is a high-severity J2EE Misconfiguration: Data Transmission Without Encryption (CWE-5) vulnerability in Apache Nimble. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Network Sniffing (T1040); ranked at the 11th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SC-13 (Cryptographic Protection) and SC-8 (Transmission Confidentiality and Integrity) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-52435 is a J2EE Misconfiguration vulnerability classified as Data Transmission Without Encryption in Apache NimBLE. The root cause is improper handling of the Pause Encryption procedure on the Link Layer, which leaves a previously encrypted Bluetooth Low Energy connection in an unencrypted state. This issue affects Apache NimBLE versions through 1.8.0 and was published on 2026-01-10.
An eavesdropper with network access can exploit this vulnerability by observing the remainder of the data exchange after the encryption pause is mishandled. The attack requires low complexity, no privileges, no user interaction, and no special scopes, resulting in high confidentiality impact with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and is associated with CWE-5.
Advisories recommend upgrading to Apache NimBLE version 1.9.0, which addresses the issue. Fixing commits include 164f1c23c18a290908df76ed83fe848bfe4a4903 and ec3d75e909fa6dcadf1836fefc4432794a673d18 on the apache/mynewt-nimble GitHub repository, with details shared on Apache mailing lists and oss-security.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-1854
Vulnerability Data
J2EE Misconfiguration: Data Transmission Without Encryption vulnerability in Apache NimBLE. Improper handling of Pause Encryption procedure on Link Layer results in a previously encrypted connection being left in un-encrypted state allowing an eavesdropper to observe the remainder of the exchange.…
more
This issue affects Apache NimBLE: through <= 1.8.0. Users are recommended to upgrade to version 1.9.0, which fixes the issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SC-13 mandates use of cryptography, which is the mechanism needed to avoid unencrypted transmission.
SC-8 directly requires protection of confidentiality and integrity for transmitted information, structurally preventing plaintext transmission.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Directly requires encryption and related protections for all data-in-transit, preventing the exact misconfiguration described.
Configuration management practices would normally enforce encrypted transit settings, but the control addresses many other settings beyond this weakness.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Directly requires use of cryptography to protect data confidentiality and integrity during transmission.
Mandates network security controls including encryption of traffic to prevent interception.
Requires secure transfer procedures that would mandate encryption for sensitive data in transit.
Requires security measures for network services, which include encryption of transmitted data.
Application security requirements may specify encryption for data in transit as a functional requirement.