VulnerabilityDeferred

CVE-2024-34268

EQ-3 Eqiva CC-RT-BLE Bluetooth Smart Radiator Thermostat Firmware up to the latest version 1.46 was discovered to allow unsecured bluetooth connections.

HIGH 7.1EPSS 0.32%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.32%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

EQ-3 Eqiva CC-RT-BLE Bluetooth Smart Radiator Thermostat Firmware up to the latest version 1.46 was discovered to allow unsecured bluetooth connections. This vulnerability allows attackers to gain full access to the device without authentication.

CVSS 3.1: 7.1 HIGHCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
EPSS: 0.32% probability · 25th percentile
CISA KEV: Not listed
Weakness: CWE-306
Source: cve@mitre.org

References

https://www.bdosecurity.de/de-de/advisories/cve-2024-34268
https://www.eq-3.com

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.