Bluetooth Broken? Apache NimBLE Flaws Enable Spoofing & Eavesdropping

According to The Apache Software Foundation, urgent patches have been issued for Apache NimBLE, the open-source Bluetooth 5.4 stack used to replace proprietary drivers on Nordic chipsets, after a cluster of four security vulnerabilities was disclosed, two of which are rated “Important” and can enable bypassing authentication or eavesdropping on encrypted connections. The flaws affect all versions up to 1.8.0, leaving unpatched IoT devices and embedded systems exposed to proximity-based attacks.

The most alarming vulnerability is an Authentication Bypass by Spoofing flaw, tracked as CVE-2025-62235, which can force a victim device to remove its original pairing bond and re-bond with an impostor, allowing a rogue device to masquerade as a trusted peripheral.

Another Important flaw, CVE-2025-52435, involves a failure in handling the Pause Encryption procedure on the Link Layer, potentially leaving a previously encrypted connection unencrypted and allowing an eavesdropper to observe the remainder of the exchange. The update also fixes CVE-2025-53477 and CVE-2025-53470, with Low severity bugs that could crash devices or corrupt memory, and NimBLE 1.9.0 has been released to address all four vulnerabilities.