CVE-2025-69969
Pebblepower Pebble Prism Ultra Firmware ≤ 2.5.8
Raw vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HSummary
CVE-2025-69969 is a critical-severity Missing Encryption of Sensitive Data (CWE-311) vulnerability in Pebblepower Pebble Prism Ultra Firmware. Its CVSS base score is 9.6 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Network Sniffing (T1040); ranked at the 38th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SC-13 (Cryptographic Protection) and SC-28 (Protection of Information at Rest) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-69969 is a critical vulnerability in the Bluetooth Low Energy (BLE) communication protocol of the SRK Powertech Pvt Ltd Pebble Prism Ultra v2.9.2 device, published on 2026-03-04. It arises from a lack of authentication and authorization mechanisms, allowing attackers to reverse engineer the protocol and execute arbitrary commands without establishing a connection. The flaw also enables cleartext data interception and unauthenticated firmware hijacking via over-the-air (OTA) services. The vulnerability carries a CVSS v3.1 base score of 9.6 (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and maps to CWE-311 (Missing Authentication) and CWE-319 (Cleartext Transmission of Sensitive Information).
The attack requires adjacency over BLE proximity with no physical contact needed, low attack complexity, no privileges, and no user interaction. Any attacker in range can exploit it to execute arbitrary commands on the device, intercept sensitive data transmitted in cleartext, and perform unauthenticated firmware hijacking through OTA services, potentially leading to full device compromise with high impacts on confidentiality, integrity, and availability.
Mitigation guidance and further details are provided in the associated GitHub security advisory (GHSA-cp6q-87g8-mq77) and the BLEached-Security repository at https://github.com/mukundbhuva/BLEached-Security.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-208281
Vulnerability Data
A lack of authentication and authorization mechanisms in the Bluetooth Low Energy (BLE) communication protocol of SRK Powertech Pvt Ltd Pebble Prism Ultra v2.9.2 allows attackers to reverse engineer the protocol and execute arbitrary commands on the device without establishing…
more
a connection. This is exploitable over Bluetooth Low Energy (BLE) proximity (Adjacent), requiring no physical contact with the device. Furthermore, the vulnerability is not limited to arbitrary commands but includes cleartext data interception and unauthenticated firmware hijacking via OTA services.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 7 hardening rules · 7 OS baselines
—
Mitigating Controls (NIST 800-53 r5) AI
SC-13 mandates use of specific cryptography, structurally preventing unencrypted sensitive data.
SC-8 directly requires protecting confidentiality of transmitted information, which structurally eliminates cleartext transmission of sensitive data.
SC-28 requires cryptographic protection of information at rest, eliminating the storage half of the weakness.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Encryption of data-in-transit directly prevents cleartext transmission while the control also addresses integrity and availability.
PR.DS-01 directly mandates encryption for data-at-rest and therefore prevents CWE-311 mostly for storage, yet the weakness also spans transmission and other contexts that this single at-rest control leaves unaddressed.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Specifying encryption and other security technology for network services prevents transmission of sensitive information in cleartext over potentially untrusted channels.
Explicit rules requiring encryption for sensitive information in transit eliminate the weakness of sending data without cryptographic protection.
Specifying communications-security requirements and secure remote-access methods (including encryption expectations) prevents the transmission of sensitive data in cleartext over home or public networks.
Armoured conduits, electromagnetic shielding and locked enclosures make passive eavesdropping on unencrypted traffic traversing the cables more difficult, mitigating exposure of sensitive data in transit.
Explicitly calling for protection of data in transit and at rest, plus secure encryption of communications, drives the implementation of encryption that prevents clear-text exposure of sensitive information.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Oracle Linux 8 (1 rule)
- V-248525 All OL 8 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at-rest protection. prevents CWE-311
Oracle Linux 9 (1 rule)
- V-271756 OL 9 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection. prevents CWE-311
RHEL 8 (1 rule)
- V-230224 All RHEL 8 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection. prevents CWE-311
RHEL 9 (1 rule)
- V-257879 RHEL 9 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection. prevents CWE-311
Windows Server 2016 (1 rule)
- V-224843 Systems requiring data at rest protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest. prevents CWE-311
Windows Server 2019 (1 rule)
- V-205727 Windows Server 2019 systems requiring data at rest protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest. prevents CWE-311