CVE-2024-2105

JBL: Improper validation of ICM field in connection requests

State: Published
Severity: 6.5 Medium
Published: Dec 10, 2025
Updated: Dec 10, 2025
Reserved: Mar 1, 2024

Description

An unauthorised attacker within bluetooth range may use an improper validation during the BLE connection request to deadlock the affected devices.

Scores

CVSS	Score	Vector	Source
3.1	6.5 Medium	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	CERTVDE

Weaknesses

CWE-1287 Improper Validation of Specified Type of Input

Affected Products

Product	Versions
Flip 5JBL	*Affected
Flip 6JBL	*Affected
Pulse 4JBL	*Affected
Pulse 5JBL	*Affected
Boombox 2JBL	*Affected
Boombox 3JBL	*Affected
Xtreme 3JBL	*Affected

References

https://harman.csaf-tp.certvde.com/.well-known/csaf/white/2025/hbsa-2025-0002.jsonvendor-advisory
https://certvde.com/en/advisories/VDE-2025-089

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.