Stealth Bluetooth Threat: 1 Billion Devices Exposed to Identity Theft

Stealth Bluetooth Threat: 1 Billion Devices Exposed to Identity Theft

The short version

• Discovery: Researchers at Spain’s Tarlogic Security found 29 undocumented commands in the Bluetooth firmware of Espressif’s ESP32 chip, which is used in more than one billion devices.
• Key Players: Tarlogic researchers Miguel Tarascó Acuña and Antonio Vázquez Blanco, chipmaker Espressif, and the makers of IoT products built on the ESP32.
• Impact: The commands allow memory reads and writes and MAC address spoofing. The flaw is tracked as CVE-2025-27840 and rated medium severity (CVSS 6.8).
• Solutions: Espressif says the commands are for debugging and will be removed in a software update.

Hidden commands in the ESP32

The ESP32 is a cheap Wi-Fi and Bluetooth microcontroller found in smart plugs, door locks, sensors and countless other connected products. It is everywhere. Espressif said it had shipped more than one billion units by 2023, and on March 8, 2025, at the RootedCON conference in Madrid, Tarlogic showed that the chip’s Bluetooth firmware answers to commands the company never documented.

What the researchers found

Using a new hardware-independent USB Bluetooth driver they built, the researchers found 29 vendor-specific HCI commands (opcode 0x3F). They can read and write RAM and flash, change the device’s MAC address to impersonate another device, and inject low-level Bluetooth packets. One of them, 0xFC02, writes directly to memory.

Who found it

Tarlogic first called the commands a backdoor. Other researchers objected. The commands are reached through the host interface on the device itself and not over the air, which means an attacker needs code running on the device, or physical access to it, before any of this becomes useful.

What it means for device owners

That limit matters. Still, the commands could help an attacker who already has a foothold: malicious firmware could use them to hide, a compromised gadget could pose as another trusted device, and a supply chain attacker could plant code that survives. Tarlogic also warned that some Bluetooth stacks might let the commands be reached remotely, depending on how they pass HCI traffic.

The fix

Espressif responded on March 10. It said the functions are “debug commands included for testing purposes” and that they cannot, by themselves, pose a security risk to ESP32 chips. It promised a software fix anyway. Device makers then have to push that firmware out to their own products, which for cheap IoT gear often never happens.

Steps for device owners

Find out whether your devices use an ESP32. Install firmware updates from the manufacturer when they appear. Businesses that deploy ESP32-based gear in offices, clinics or plants should also limit who can touch the hardware and watch for firmware that changes without an approved update.

Why it still matters

The finding is a reminder that small chips in everyday devices can carry undocumented features. Tarlogic’s new driver also makes this kind of low-level Bluetooth research cheaper, so more findings like this are likely.

For now, the realistic risk is in supply chains and devices that are already compromised. Mass remote identity theft is unlikely.

Frank Jones, CISSP

Frank Jones has loved computers from the age of 13. Frank got his hacking career started when he downloaded a war dialing program that he used to detect dial up modems in his hometown of Chicago. Frank Jones now works as a JAVA coder and cyber security researcher.