by Kastro
Paper/Archive/CVE-2025-9994

CVE-2025-9994

Amped RF BT-AP 111 — Amp’ed RF BT-AP 111 Bluetooth access point's HTTP admin interface does not require authentication

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
39
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 45.7.457 × 209.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The Amp’ed RF BT-AP 111 Bluetooth access point's HTTP admin interface does not have an authentication feature, allowing unauthorized access to anyone with network access.

Affected

ProductAffectedFixed inSource
BT-AP 111all versions–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refampedrftech.com/guides/BT-AP111_UserManual.pdfrefkb.cert.org/vuls/id/763183