Vulnerability · Published Jan 7, 2026 · Assigned by VulnCheck

CVE-2025-15474AuntyFey Smart Combination Lock BLE Connection Flood DoS

Medium 5.3

In plain English

A medium-severity resource allocation without limits in AuntyFey Smart Combination Lock from AuntyFey. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 4.0)5.3Medium

Exploit odds (30 days)0.3%top 74.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Public PoC

Official description

AuntyFey Smart Combination Lock firmware versions as of 2025-12-24 contain a vulnerability that allows an unauthenticated attacker within Bluetooth Low Energy (BLE) range to cause a denial of service by repeatedly initiating BLE connections. Sustained connection attempts interrupt keypad authentication input and repeatedly force the device into lockout states, preventing legitimate users from unlocking the device.

Affected products (as reported)

Vendor	Product	Versions
AuntyFey	AuntyFey Smart Combination Lock	0 – through 2025-12-24

Weakness: CWE-770 · Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

https://github.com/nsm-barii/ble-smartlock-dos technical-description, exploit
https://www.amazon.com/dp/B0F9L1M4XG product
https://www.vulncheck.com/advisories/auntyfey-smart-combination-lock-ble-connection-flood-dos third-party-advisory