CVSS 4.0
5.2 mediumCVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:UCVE-2025-55297
Medium (5.2) in espressif esp-idf. EPSS 0.4% chance of exploitation in the next 30 days.
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. The BluFi example bundled in ESP-IDF was vulnerable to memory overflows in two areas: Wi-Fi credential handling and Diffie–Hellman key exchange. This vulnerability is fixed in 5.4.1, 5.3.3, 5.1.6, and 5.0.9.
Severity
CVSS 3.1
8.8 highCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 29% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-120, CWE-131
- Published
- Modified
- Record from
- the NVD, synced
Affected
- espressif:esp-idf
References
- https://github.com/espressif/esp-idf/commit/12b7a9e6d78012ab9184b7ccdb5524364bf7e345
- https://github.com/espressif/esp-idf/commit/3fc6c93936077cb1659e1f0e0268e62cf6423e9d
- https://github.com/espressif/esp-idf/commit/5f93ec3b11b6115475c34de57093b3672d594e8f
- https://github.com/espressif/esp-idf/commit/9cb7206d4ae8fd8f4296cd57d6c78a1656f42efa
- https://github.com/espressif/esp-idf/commit/abc18e93eb3500dbec74c3e589671ef82c8b3919