jasonw88/esp32-cve-2025-27840-power-trace-experimentFirmware for getting a power trace of the behavior of the bluetooth module on the ESP32 when the ESP32 is sent the undocumented hci bluetooth commands (CVE-2025-27840). Uses ESP-IDF v5.0.8 and v5.0.9.
Firmware for getting a power trace of the behavior of the bluetooth module on the ESP32 when the ESP32 is sent the undocumented hci bluetooth commands (CVE-2025-27840).
When the ESP32 receives the commands, it toggles a GPIO pin to trigger the power trace capture. I recommend using a trace hook to do this when the bluetooth controller task gets scheduled. You can view trigger mechanisms in the trigger-mechanisms folder.
The code is compatible with ESP-IDF v5.0.8 and v5.0.9 and was adapted off Espressif's controller_hci_uart_esp32 example.
You can view a full detailed technical write-up and replication steps in the docs folder.
A python script (written with pyserial) to test sending and receiving hci commands can be found in the scripts folder.
