CVE-2025-15474

AuntyFey Smart Combination Lock BLE Connection Flood DoS

CVSS 5.3 MEDIUMEPSS 0.3%CWE-770

Vexday Risk Score

13Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 5.3EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

07 Jan 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

AuntyFey Smart Combination Lock firmware versions as of 2025-12-24 contain a vulnerability that allows an unauthenticated attacker within Bluetooth Low Energy (BLE) range to cause a denial of service by repeatedly initiating BLE connections. Sustained connection attempts interrupt keypad authentication input and repeatedly force the device into lockout states, preventing legitimate users from unlocking the device.

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Affected products

AuntyFey · AuntyFey Smart Combination Lock

References

https://github.com/nsm-barii/ble-smartlock-dos https://www.amazon.com/dp/B0F9L1M4XG https://www.vulncheck.com/advisories/auntyfey-smart-combination-lock-ble-connection-flood-dos