CVE-2025-48571: Android Bluetooth SMS Interception Vulnerability (CVSS 4.3)

Technical summary

CVE-2025-48571 stems from improper protection mechanism logic in multiple functions within Google Android's btm_sec.cc file, which manages Bluetooth security state. The flaw allows a network-adjacent attacker to bypass intended SMS message confidentiality controls via a logic error. The vulnerability is classified as CWE-693 (Protection Mechanism Failure), indicating the root cause is a failure in the code's access control or state management during Bluetooth operations. No privilege escalation is required from the attacker's perspective, and successful exploitation results in information disclosure of SMS content.

Business impact

SMS message interception poses significant risk to organizations and users relying on SMS for sensitive communications. Attackers could capture authentication codes sent via SMS, compromising multi-factor authentication schemes. Business continuity impact is moderate given the user-interaction requirement, but any compromise of SMS confidentiality should be treated as a signal to audit your authentication architecture. Organizations should review whether SMS-based secrets (OTPs, password reset links) are still in use and consider shifting to app-based or hardware-backed authentication where feasible.

Affected systems

Google Android devices running versions prior to the patched release are affected. The vulnerability exists in core Bluetooth security handling code, meaning any Android device with Bluetooth capability and the vulnerable code path active is at risk. End users and enterprises with unpatched Android devices are in scope, particularly those handling sensitive data via SMS or relying on SMS-based authentication.

Exploitability

Exploitation requires network proximity (the attacker must be in Bluetooth range or on the same network segment), no special privileges, and user interaction. The user-interaction requirement—likely tied to an active Bluetooth operation or connection state—means this is not a zero-click vulnerability. An attacker would need to be present during the window when a user initiates or maintains a Bluetooth connection, making opportunistic, large-scale attacks less practical. However, targeted attacks against known individuals in controlled environments remain feasible.

Remediation

Apply the security patch released by Google for the affected Android version. Verify the patch is installed via Settings > About Phone > Android Security Patch Level. Organizations should prioritize patching devices used for sensitive communications or authentication workflows. Until patching is complete, users should disable Bluetooth when not actively needed and avoid initiating Bluetooth connections in untrusted environments.

Patch guidance

Consult Google's Android Security & Privacy Year in Review or official Android Security Bulletin for the specific version and release date addressing CVE-2025-48571. Patches are typically rolled out via monthly security updates. Verify the installed Android security patch level matches or exceeds the date when Google released the fix. Device manufacturers may bundle the patch in their own over-the-air updates; check your device manufacturer's security advisory as well. Enterprise deployments should test the patch in a staging environment before broad rollout to ensure compatibility with custom Bluetooth integrations.

Detection guidance

Detection of active exploitation is challenging without elevated logging, as the attack occurs at the Bluetooth protocol level. Network monitoring may reveal suspicious Bluetooth pairing attempts or unusual connection patterns during SMS receipt. On the device itself, enable verbose Bluetooth logging (if available in developer options) and monitor system logs for btm_sec.cc errors or state machine anomalies. SIEM solutions should correlate SMS events with unexpected Bluetooth state changes or device-log anomalies. Intrusion detection systems with Bluetooth protocol awareness may flag malformed Bluetooth frames during the attack window.

Why prioritize this

This vulnerability merits swift but not emergency-level patching. The CVSS score of 4.3 reflects medium severity; while SMS interception is concerning, the user-interaction requirement and limited exploit window prevent this from being a critical 0-day. However, the targeting of authentication infrastructure (SMS OTPs) means it should be prioritized ahead of less-sensitive issues. Organizations using SMS for 2FA should patch within 30 days; others within 60 days. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog, suggesting in-the-wild exploitation remains limited.

Risk score, explained

CVSS 3.1 score of 4.3 (MEDIUM) accurately reflects the threat. Network reachability (AV:N) and low attack complexity (AC:L) are offset by the requirement for user interaction (UI:R), no privileges needed (PR:N), and a limited scope affecting only confidentiality (C:L/I:N/A:N). The score appropriately penalizes the attack for its user-interaction requirement, preventing a higher severity rating despite the sensitive nature of SMS data. Organizations should not interpret a 4.3 as low-risk; rather, it reflects a moderate threat that is meaningful but not universally critical.

Frequently asked questions