Skip to content
fr Sign in
Not rated

CVE-2025-52435 J2EE Misconfiguration: Data Transmission Without Encryption vulnerability in Apache NimBLE

Description

J2EE Misconfiguration: Data Transmission Without Encryption vulnerability in Apache NimBLE. Improper handling of Pause Encryption procedure on Link Layer results in a previously encrypted connection being left in un-encrypted state allowing an eavesdropper to observe the remainder of the exchange. This issue affects Apache NimBLE: through <= 1.8.0. Users are recommended to upgrade to version 1.9.0, which fixes the issue.

Affected products and versions

Product Affected versions Fixed in
Apache Mynewt NimBLE 1.8 earliest → 1.8.0 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Apache Mynewt NimBLE

The 4 CVEs of Apache Mynewt NimBLE →
CVE-2025-53470 Out-of-bounds Read vulnerability in Apache NimBLE HCI H4 driver Not rated CVE-2025-53477 NULL Pointer Dereference vulnerability in Apache Nimble Not rated CVE-2025-62235 Authentication Bypass by Spoofing vulnerability in Apache NimBLE Not rated
Track this CVE