A lack of authentication and authorization mechanisms in the Bluetooth Low Energy (BLE) communication protocol of SRK Powertech Pvt Ltd Pebble Prism Ultra v2.9.2 allows attackers to reverse engineer the protocol and execute arbitrary commands on the device without establishing a connection. This is exploitable over Bluetooth Low Energy (BLE) proximity (Adjacent), requiring no physical contact with the device. Furthermore, the vulnerability is not limited to arbitrary commands but includes cleartext data interception and unauthenticated firmware hijacking via OTA services.
References
| Link | Resource |
|---|---|
| https://github.com/mukundbhuva/BLEached-Security | Exploit Third Party Advisory |
| https://github.com/mukundbhuva/BLEached-Security/security/advisories/GHSA-cp6q-87g8-mq77 | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
09 Mar 2026, 17:26
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Pebblepower
Pebblepower pebble Prism Ultra Firmware Pebblepower pebble Prism Ultra |
|
| CPE | cpe:2.3:h:pebblepower:pebble_prism_ultra:-:*:*:*:*:*:*:* cpe:2.3:o:pebblepower:pebble_prism_ultra_firmware:*:*:*:*:*:*:*:* |
|
| References | () https://github.com/mukundbhuva/BLEached-Security - Exploit, Third Party Advisory | |
| References | () https://github.com/mukundbhuva/BLEached-Security/security/advisories/GHSA-cp6q-87g8-mq77 - Exploit, Third Party Advisory |
04 Mar 2026, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-03-04 17:16
Updated : 2026-03-09 17:26
NVD link : CVE-2025-69969
Mitre link : CVE-2025-69969
CVE.ORG link : CVE-2025-69969
JSON object : View
Products Affected
pebblepower
- pebble_prism_ultra
- pebble_prism_ultra_firmware