CVE-2025-67133
Published: 09 January 2026
Summary
CVE-2025-67133 is a high-severity Uncontrolled Resource Consumption (CWE-400) vulnerability in Heromotocorp Vida V1 Pro Firmware. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 11.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SC-6 (Resource Availability).
Deeper analysis
CVE-2025-67133 is a denial-of-service vulnerability affecting the Hero Motocorp Vida V1 Pro software version 2.0.7, specifically within its BLE (Bluetooth Low Energy) component. Published on 2026-01-09, the issue stems from CWE-400 (Uncontrolled Resource Consumption) and has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high severity primarily due to its impact on availability.
A local attacker can exploit this vulnerability by leveraging the BLE component to trigger a denial of service, disrupting the affected device's functionality. The CVSS vector suggests network accessibility with low complexity, no privileges or user interaction required, and unauthenticated access, as implied by the reference to an unauthenticated BLE connection.
Advisories and references, including https://threadpoolx.gitbook.io/docs/cve/cve-2025-67133-denial-of-service-via-unauthenticated-ble-connection and https://www.vidaworld.com/, provide further details on the vulnerability but do not specify mitigation steps or patches in the available information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-1721
Vulnerability details
An issue in Hero Motocorp Vida V1 Pro 2.0.7 allows a local attacker to cause a denial of service via the BLE component
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct exploitation of the uncontrolled resource consumption flaw in the BLE component enables endpoint DoS via application/system exploitation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly implements denial-of-service protections at the BLE entry point to prevent resource exhaustion attacks.
Protects system resource availability against uncontrolled consumption triggered via the BLE component.
Establishes restrictions and safeguards for wireless access including BLE to mitigate unauthenticated DoS exploitation.