cipherx1802/cve-2026-31280-insecure-bluetooth-rfcomm-leading-to-device-crash-in-parani-m10-intercomProof-of-concept demonstrating an unauthenticated Bluetooth RFCOMM service in Parani M10 Intercom that allows arbitrary payload delivery, leading to device crash.
A Bluetooth Classic RFCOMM service of Parani M10 Intercom is exposed without enforcing secure authentication or proper access control. Once within range, any device can Establish a connection without proper pairing restrictions, Access RFCOMM channels directly or Send arbitrary or malformed payloads
The Proof of Concept (PoC) for this vulnerability is documented in the attached PDF, which was originally provided for internal security review to the respective organization.
Discoverer(s) - Nikhil Yalgar(CipherX1802) & Tapadyuti Baral
