CVE-2025-36755

CleverDisplay BlueOne unauthorized BIOS access through physical USB keyboard

State: Published
Severity: 2.4 Low
Published: Dec 12, 2025
Updated: Dec 13, 2025
Reserved: Apr 15, 2025

Description

The CleverDisplay BlueOne hardware player is designed with its USB interfaces physically enclosed and inaccessible under normal operating conditions. Researchers demonstrated that, after cicumventing the device’s protective enclosure, it was possible to connect a USB keyboard and press ESC during boot to access the BIOS setup interface. BIOS settings could be viewed but not modified. This behavior slightly increases the attack surface by exposing internal system information (CWE-1244) once the enclosure is removed, but does not allow integrity or availability compromise under standard or tested configurations.

Scores

CVSS	Score	Vector	Source
4.0	2.4 Low	CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/S:N/AU:N/V:D/RE:L/U:Green	DIVD

Weaknesses

CWE-1244 Internal Asset Exposed to Unsafe Debug Access Level or State
CWE-1191 On-Chip Debug and Test Interface With Improper Access Control

Affected Products

Product	Versions
BlueOne (CleverDisplay Hardware Player)CleverDisplay B.V.	12.11.1Affected 12.12.1 and laterNot affected

References

https://csirt.divd.nl/CVE-2025-5743/third-party-advisory
https://csirt.divd.nl/DIVD-2025-00043third-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.