CVE-2025-64342

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. When the ESP32 is in advertising mode, if it receives a connection request containing an invalid Access Address (AA) of 0x00000000 or 0xFFFFFFFF, advertising may stop unexpectedly. In this case, the controller may incorrectly report a connection event to the host, which can cause the application layer to assume that the device has successfully established a connection. This issue has been fixed in versions 5.5.2, 5.4.3, 5.3.5, 5.2.6, and 5.1.7. At time of publication versions 5.5.2, 5.3.5, and 5.1.7 have not been released but are fixed respectively in commits 3b95b50, e3d7042, and 75967b5.

• CWE-754

• https://github.com/espressif/esp-idf/commit/309f031dd6b04de30c926a256508c65b0df95dfa
• https://github.com/espressif/esp-idf/commit/3b95b50703cd3301a370cffaa1cc299b1941fe2a
• https://github.com/espressif/esp-idf/commit/75967b578563ea7876dc215251cbb6d64bc9d768
• https://github.com/espressif/esp-idf/commit/8ec541023684d33b498fa21c5b4724bce748aa7b
• https://github.com/espressif/esp-idf/commit/bf66761962579f73aea682d1154b9c99b9d3d7dc
• https://github.com/espressif/esp-idf/commit/e3d70429566ece1ef593d36aa4ebd320e0c95925
• https://github.com/espressif/esp-idf/security/advisories/GHSA-8mg7-9qpg-p92v

Published

Nov 17, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-64335Suricata is a network IDS, IPS and NSM engine developed by t…7.5
• CVE-2025-64336ClipBucket v5 is an open source video sharing platform. In v…5.4
• CVE-2025-64338ClipBucket v5 is an open source video sharing platform. In v…9
• CVE-2025-64339ClipBucket v5 is an open source video sharing platform. In v…5.4
• CVE-2025-6434The exception page for the HTTPS-Only feature, displayed whe…4.3
• CVE-2025-64340FastMCP is the standard framework for building MCP applicati…7.8
• CVE-2025-64343(conda) Constructor is a tool that enables users to create i…7.8
• CVE-2025-64344Suricata is a network IDS, IPS and NSM engine developed by t…7.5
• CVE-2025-64345Wasmtime is a runtime for WebAssembly. Prior to version 38.0…1.8
• CVE-2025-64346archives is a Go library for extracting archives (tar, zip, …6
• CVE-2025-64347Apollo Router Core is a configurable Rust graph router writt…7.5
• CVE-2025-64348ELOG allows an authenticated user to modify or overwrite the…7.1