CVE-2025-32061
Last modified
CVE-2025-32061 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. The specific flaw exists within the Bluetooth stack developed by Alps Alpine of the Infotainment ECU manufactured by Bosch. The issue results from the lack of proper boundary validation of user-supplied data, which can result in a stack-based buffer overflow when receiving a specific packet on the established upper layer L2CAP channel. EPSS estimates a 0.38% chance of exploitation in the next 30 days.
Description
The specific flaw exists within the Bluetooth stack developed by Alps Alpine of the Infotainment ECU manufactured by Bosch. The issue results from the lack of proper boundary validation of user-supplied data, which can result in a stack-based buffer overflow when receiving a specific packet on the established upper layer L2CAP channel. An attacker can leverage this vulnerability to obtain remote code execution on the Infotainment ECU with root privileges. First identified on Nissan Leaf ZE1 manufactured in 2020.
Metrics
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2025-32061?
How severe is CVE-2025-32061?
How do I fix CVE-2025-32061?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-32056The anti-theft protection mechanism can be bypassed by attac…4
- CVE-2025-32057The Infotainment ECU manufactured by Bosch which is installe…6.5
- CVE-2025-32058The Infotainment ECU manufactured by Bosch uses a RH850 modu…9.3
- CVE-2025-32059The specific flaw exists within the Bluetooth stack develope…8.8
- CVE-2025-3206A vulnerability has been found in code-projects Hospital Man…7.5
- CVE-2025-32060The system suffers from the absence of a kernel module signa…6.7
- CVE-2025-32062The specific flaw exists within the Bluetooth stack develope…8.8
- CVE-2025-32063There is a misconfiguration vulnerability inside the Infotai…6.8
- CVE-2025-32067Improper Input Validation vulnerability in The Wikimedia Fou…5.4
- CVE-2025-32068Incorrect Authorization vulnerability in The Wikimedia Found…5.4
- CVE-2025-32069Improper Input Validation vulnerability in The Wikimedia Fou…5.4
- CVE-2025-3207A vulnerability was found in code-projects Patient Record Ma…7.5
Are you affected by CVE-2025-32061?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST