Amp’ed RF BT-AP 111 Bluetooth Access Point Vulnerability Enables Admin Takeover

The article discusses a critical vulnerability in the Amp’ed RF BT-AP 111 Bluetooth Access Point, which exposes its HTTP-based administrative interface without authentication controls. This flaw allows unauthenticated attackers with network access to gain full administrative privileges, risking unauthorized configuration changes, data interception, and network compromise. The device supports multiple Bluetooth connections and is intended for configuring Bluetooth profiles and network parameters.

However, the lack of authentication means that anyone on the local network can modify or erase configuration settings, potentially leading to severe security breaches. The article emphasizes that this oversight violates NIST best practices for device security, which mandate authentication for remote interfaces.

As no vendor response has been received regarding a firmware update, the article recommends network-level controls, such as placing the device behind access-controlled VLANs and implementing strict firewall rules to mitigate risks.