- Bluetooth security flaw discovered in common chipset.
- Researchers’ own software bypasses APIs.
- Threat to supply chains possible.
One of the most common microchips in the world, used in billions of typically small, networked devices has been found to have undocumented Bluetooth features that could pose a security risk.
Researchers at Tarlogic Security discovered undocumented commands in the ESP32 chip’s Bluetooth firmware that could be used to allow an attacker low-level control over Bluetooth and other functions. The ESP32 is near-ubiquitous in many devices, often providing Bluetooth and wi-fi features. ESP32s can be found in home automation hardware, internet-of-things devices, industrial IoT hardware, and thousands of other items like networked CCTV cameras, smart gadgets, and control and attenuation systems.
A typical circuit board with an ESP32 chip costs less than a couple of US dollars retail, and the chip is typically bought by the multiple thousand by IoT device manufacturers, among many others.
The undocumented ESP32 Bluetooth commands were only discovered after Tarlogic wrote its own USB Bluetooth drivers using computer programming language C. They used code to get direct access to Bluetooth hardware without having to rely on manufacturer-provided APIs – the typical way that software interacts with Bluetooth subsytems. Use of bespoke code allowed researchers to access the Bluetooth functionality of ESP32 chips directly, and they discovered a class of undocumented commands giving access to low-level software commands capable of complete control over several core functions.
The researchers stated that one ability, relatively simply attained, would the spoofing of trusted devices’ identities on a network – giving attackers a foothold, therefore, in a victim’s network, and a place from where other attacks could be mounted.
The Spanish company’s team discovered 29 undocumented commands that could be used to read and write a device’s RAM and Flash storage (to give malicious code persistence), inject LMP/LLCP packets (used to connect Bluetooth-enabled devices), and spoof the unique identifying code (the MAC address) that the Bluetooth protocol publishes to identify itself.
Attackers could gain access to hardware with an ESP32 chip either through Bluetooth, or physical USB and/or UART ports. But the largest potential threat would be the compromise of devices at OEM level, where a supply chain-focused attack would massively amplify the reach of any compromise to many devices sold into the wild.
The makers of the ESP32, Espressif, published a statement on March 10, stating that the undocumented Opcodes were for internal debugging purposes and used for internal testing only.
“[The] debug commands are part of Espressif’s implementation of the HCI (Host Controller Interface) protocol used in Bluetooth technology. This protocol is used internally in a product to communicate between Bluetooth layers,” the statement reads.
Espressif has said that it will remove the debugging commands in a future software update. It said that although the commands exist, they are not a security risk to ESP32 chips, given the difficulty in accessing the Opcodes.
In the researchers’ presentation of their findings at the RootedCON event in Madrid on March 8, 2025, they stated that in general, Bluetooth security research has become less common – not because the technology is secure, but because interest in the field has waned. Most attacks on Bluetooth don’t work on generic hardware, the audience was told, and/or require tools that are no longer supported or developed. The targeting of commonplace chipsets such as the ESP32 means that thousands of manufacturers’ devices could be potentially at risk until patches are released by Espressif.
In the interim, the security flaw has been given an entry in NIST’s vulnerability database as CVE-2025-27840.
