Vulnerability · Published Dec 10, 2025 · Assigned by CERTVDE

CVE-2024-2105JBL: Improper validation of ICM field in connection requests

Medium 6.5

In plain English

A medium-severity security flaw in Boombox 2 from JBL. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.2%top 90.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An unauthorised attacker within bluetooth range may use an improper validation during the BLE connection request to deadlock the affected devices.

Affected products (as reported)

Vendor	Product	Versions
JBL	Flip 5	*
JBL	Flip 6	*
JBL	Pulse 4	*
JBL	Pulse 5	*
JBL	Boombox 2	*
JBL	Boombox 3	*
JBL	Xtreme 3	*

Weakness: CWE-1287 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://harman.csaf-tp.certvde.com/.well-known/csaf/white/2025/hbsa-2025-0002.json vendor-advisory
https://certvde.com/en/advisories/VDE-2025-089