nsm-barii/cve-2025-15474A denial-of-service vulnerability in the AuntyFey BLE smart padlock allows unauthenticated connection floods to lock out legitimate users. CVE-2025-15474
An unauthenticated Bluetooth Low Energy (BLE) connection flood can reliably prevent legitimate users from unlocking the device by interrupting keypad input and forcing repeated lockout states.
This repository documents a Denial-of-Service (DoS) vulnerability affecting a commercial BLE smart padlock
(Amazon Product).
The device exposes a static BLE MAC address (no RPA) and accepts unauthenticated connection attempts.
By repeatedly initiating BLE connections in a loop, an attacker can interfere with the lock’s keypad authentication flow, preventing users from completing PIN entry.
This behavior is not caused by incorrect password attempts — the user is denied sufficient time to enter the PIN before the device forcibly enters a lockout state.
As long as the attack is sustained, the device remains effectively unusable.
bleak Python librarypython3 -m venv venv
source venv/bin/activate
pip install bleak
python3 poc.py -m <target_mac>
This initiates unauthenticated BLE connection attempts in a loop.
The lock becomes unusable, consistently interrupting user input and forcing lockout behavior.
Below is a still image from a live attack session where the device's keypad was rendered non-functional:
This proof-of-concept is provided strictly for educational and responsible disclosure purposes.
This vulnerability is being reported responsibly to the vendor and relevant CVE authorities.