rupeshsurve04/cve-2025-67399Documentation of CVE-2025-67399: physical UART debug interface exploitation on AIRTH Smart Home AQI Monitor (BK7231N SoC) enabling unauthorized firmware extraction via exposed programming pins.
The AIRTH Smart Home AQI Monitor uses a CB3S Bluetooth SoC based on the BK7231N chipset with Software version number: 2.1.17. By physically accessing the device and identifying the SoC, the exposed UART debug/programming pins were located using the publicly available datasheet. Direct connection to these pins via a USB-to-TTL converter and vendor-provided tools allowed unrestricted read access to the chip’s memory. As a result, the complete firmware could be extracted without authentication or security checks. This issue is caused by missing hardware-level protections such as disabled debug interfaces, read-out protection, or secure boot, enabling unauthorized firmware and memory access through the UART interface.
CVSS 3.1 Vector: AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
