Amp’ed RF BT-AP 111 Bluetooth Access Point Vulnerability Enables Admin Takeover

The Amp’ed RF BT-AP 111 Bluetooth Access Point has been discovered to expose its HTTP-based administrative interface entirely without authentication controls, enabling unauthenticated attackers with network access to seize full administrative privileges.

This critical security oversight undermines fundamental defensive measures and places deployments at risk of unauthorized configuration changes, data interception, and network compromise.

The BT-AP 111, a Bluetooth-to-Ethernet bridge supporting up to seven simultaneous Bluetooth connections and featuring Universal Plug and Play (UPnP) capability on the Ethernet side, provides administrators with a web interface accessible on port 80.

According to Amp’ed RF’s official documentation(CVE-2025-9994), this interface is intended for configuring Bluetooth profiles, network parameters, and serial-over-Bluetooth settings via a UART serial abstraction.

However, testing has revealed that the interface lacks any form of login, password challenge, or access control tokens. As a result, anyone able to reach the device over the network can immediately view, modify, or erase all configuration settings.

In practice, this means an attacker connected to the local LAN—or through a misconfigured VPN or exposed Ethernet port—can change Bluetooth pairing parameters, disable encryption, reroute traffic through malicious proxies, or even alter firmware update servers.

Such actions could facilitate man-in-the-middle eavesdropping, unauthorized device pairing, and persistent implanting of malicious code.

The absence of authentication also opens the door to configuration lockout, denial-of-service, and subsequent lateral movement across the network.

Deviation from NIST Best Practices

NIST guidance consistently mandates authentication as a baseline control for devices offering remote or near-field interfaces.

The NIST Guide to Bluetooth Security (SP 800-121 Rev. 2) designates Service Level 2 as requiring authentication, with Service Level 1 recommending both authentication and authorization for administrative functions.

Furthermore, NIST SP 800-124 Rev. 1 advises that all devices enforce robust access controls before exposing configuration or administrative resources.

By omitting even the most elementary authentication barrier, the BT-AP 111 contravenes these established best practices, leaving operators without a reliable defense-in-depth layer.

Industry standards underline that embedded devices—even those primarily designed for close-range communication—must treat administrative interfaces with the same rigor as traditional network appliances.

The BT-AP 111’s failure to do so not only violates guidance but also exposes organizations to regulatory and compliance repercussions if security controls are deemed insufficient.

Mitigations

At present, CERT/CC has not received any vendor response indicating a forthcoming firmware update or patch to address the authentication gap.

With no in-device remediation available, administrators must resort to network-level controls to limit exposure.

It is strongly recommended that organizations place any BT-AP 111 units behind access-controlled VLANs or air-gapped segments inaccessible to untrusted users.

Implementing strict firewall rules to block port 80 on the device from all but trusted management stations can effectively prevent unauthorized access.

In environments where isolation is unfeasible, consider deploying inline intrusion prevention systems configured to detect HTTP requests to known BT-AP 111 management endpoints and drop such traffic.

Regular network scans should include checks for the presence of unauthenticated BT-AP 111 interfaces to ensure newly added devices do not inadvertently expose the vulnerable interface.

Until Amp’ed RF releases an authenticated management update, the only viable defense against full-control compromise is comprehensive network segregation combined with vigilant monitoring of Bluetooth bridge deployments.

This vulnerability was reported by Souvik Kandar. The advisory document and technical write-up were authored by Timur Snoke.

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.