Critical Vulnerabilities in Bluetooth Protocol Stack Expose Millions of Devices to Remote Code Execution Attacks

A new and critical security threat, PerfektBlue, has emerged, targeting OpenSynergy’s BlueSDK Bluetooth framework and posing an unprecedented risk to the automotive industry.

This sophisticated attack vector enables remote code execution (RCE) on millions of devices across automotive and other industries through a series of memory corruption and logical vulnerabilities. 

Key Takeaways
1. Four chained vulnerabilities in BlueSDK enable one-click remote code execution via Bluetooth.
2. Millions of Mercedes-Benz, Volkswagen, and Škoda vehicles affected through compromised infotainment systems.
3. Attackers gain GPS tracking, audio recording, personal data access, and potential vehicle ECU control.
4. Despite September 2024 fixes, automotive supply chain delays left some manufacturers unpatched until June 2025.

The exploit chain requires minimal user interaction and poses severe risks to in-vehicle infotainment (IVI) systems, potentially allowing attackers to access GPS coordinates, audio recordings, personal data, and perform lateral movement to critical vehicle electronic control units (ECUs).

Critical Flaws in OpenSynergy’s BlueSDK Bluetooth Framework

PCA Cyber Security has reported to Cyber Security News that the attack utilizes a sophisticated exploitation chain, which combines four distinct vulnerabilities that can be executed with minimal user interaction, necessitating at most a single click from the targeted user.

The attack methodology exploits the framework nature of BlueSDK, where different vendors implement varying security configurations and pairing mechanisms.

The exploitation process begins with establishing a Bluetooth connection to the target device, typically requiring pairing to achieve appropriate security communication levels. 

However, the specific pairing requirements vary significantly between implementations due to BlueSDK’s framework architecture. 

Some devices may have unlimited pairing requests, others require user interaction, and certain configurations might disable pairing entirely. This variability creates a complex attack surface where exploitation requirements differ across manufacturers and device types.

The attack’s potency lies in its ability to achieve remote code execution through Bluetooth communication protocols, specifically targeting AVRCP (Audio/Video Remote Control Profile), L2CAP (Logical Link Control and Adaptation Protocol), and RFCOMM (Radio Frequency Communication) layers. 

Once successful, attackers gain user-level privileges within the target system, enabling further exploitation and lateral movement.

The PerfektBlue attack chain consists of four critical vulnerabilities, each assigned specific CVE identifiers. 

CVE-2024-45434 represents the most severe vulnerability, a Use-After-Free (UAF) condition in the AVRCP service, with a CVSS score of 8.0. 

This memory corruption vulnerability occurs when the system fails to validate object existence before performing operations, allowing attackers to manipulate freed memory regions and execute arbitrary code.

CVE-2024-45431 involves improper validation of L2CAP channel remote Channel Identifiers (CID), scoring 3.5 on the CVSS scale. 

This vulnerability permits attackers to create L2CAP channels with null identifiers as remote CIDs, potentially bypassing security mechanisms. 

CVE-2024-45433 and CVE-2024-45432 both target the RFCOMM protocol implementation, scoring 5.7 each. 

The former involves incorrect function termination, lacking proper return control flow after detecting unusual conditions, while the latter stems from function calls with incorrect parameters using the wrong variables as arguments.

The technical exploitation requires a deep understanding of Bluetooth protocol stacks, memory management, and embedded system architectures. 

Attackers must chain these vulnerabilities sequentially, exploiting the UAF condition in AVRCP after establishing compromised L2CAP and RFCOMM connections through the other vulnerabilities.

Mitigations

The scope of PerfektBlue’s impact extends across major automotive manufacturers, with confirmed vulnerabilities in Mercedes-Benz, Volkswagen, and Škoda vehicles. 

Proof-of-concept exploits have been successfully demonstrated on Mercedes-Benz NTG6/NTG7 head units, Volkswagen MEB ICAS3 infotainment systems (ID.4 model line), and Škoda MIB3 head units (Superb model line). 

Each exploitation grants attackers user-level privileges such as phone or sint_sec_btapp permissions within IVI systems.

The automotive industry’s complex supply chain has complicated patch deployment, with some manufacturers not receiving patches until June 2025, despite OpenSynergy releasing fixes in September 2024. 

This delay highlights critical vulnerabilities in the automotive cybersecurity supply chain management.

Mitigation strategies include immediate firmware updates for affected devices, disabling Bluetooth functionality when not required, and implementing network segmentation to prevent lateral movement from IVI systems to critical vehicle components. 

Manufacturers should prioritize security validation in Bluetooth stack implementations and establish robust vulnerability disclosure processes. 

Investigate live malware behavior, trace every step of an attack, and make faster, smarter security decisions -> Try ANY.RUN now