CVE-2025-67133: Unauthenticated BLE DoS in Hero MotoCorp VIDA V1 Pro

Critical Vulnerability Information Vulnerability Title CVE-2025-67133: Denial of Service via Unauthenticated BLE Connection Affected Product Product: Hero MotoCorp VIDA V1 Pro Firmware Version: 2.0.7 Severity 5.3 - Medium (CVSS v4.0) Affected Components Firmware 2.0.7 BLE connection handling logic BLE authentication/bonding process Technical Description This vulnerability arises from the device accepting unauthenticated BLE connections. A malicious device can establish a BLE connection with the scooter without prior pairing or bonding, occupying a BLE session slot and preventing legitimate applications from connecting. This results in a temporary Denial of Service (DoS) for the user. Proof of Concept (PoC) Reproduction Steps 1. Open the nRF Connect Android application. 2. Scan for nearby BLE devices and locate HMC_8810 (VIDA V1 Pro). 3. Click Connect — connection is established without authentication. 4. Now open the My VIDA app and attempt to connect. - The device no longer appears or is reported as unavailable. Evidence/Output 1. BLE device discovered via nRF Connect. 2. Device name characteristic is visible and writable (0x2A00). 3. My VIDA app cannot find or connect to the scooter. Exploitation Conditions The attack is possible under the following conditions: The scooter’s BLE module is not connected to any official app. The attacker is within BLE range (approximately 10 meters). No prior pairing or authentication is required. Impact Analysis Security Impact Confidentiality: None Integrity: None Availability: Low (DoS - temporary) Attacker Capabilities The attacker can: Connect to the scooter’s BLE module Block legitimate users from connecting Temporarily interrupt app-based interactions This attack does not grant code execution, data access, or permanent control. CVSS Score (v4.0) CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N Base Score: 5.3 (Medium) Recommended Remediation The scooter should enforce: BLE pairing/bonding, or Authentication checks for connections Prevention of unauthorized/unpaired device connections Requirement for official app authentication before establishing a BLE session Additionally: Reject unpaired connections Immediately terminate attacked or unauthorized connections.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2025-67133: Unauthenticated BLE DoS in Hero MotoCorp VIDA V1 Pro