Critical authentication bypass flaw reported in Amp'ed RF BT-AP 111 Bluetooth access point
Take action: If you have Amp'ed RF BT-AP 111 Bluetooth Access Points, make sure they are isolated on a separate VLAN since they have no authentication protection on their admin interface, and there is no vendor patch. Consider replacing these devices entirely.
Learn More
Security researchers have identified a critical vulnerability in the Amp'ed RF BT-AP 111 Bluetooth Access Point that exposes its HTTP-based administrative interface without any authentication controls.
The Amp'ed RF BT-AP 111 serves as a Bluetooth-to-Ethernet bridge device designed to function as either an access point or Bluetooth gateway in enterprise environments. The device supports Universal Plug and Play (UPnP) functionality on the Ethernet side while simultaneously acting as a UART Serial device capable of handling up to seven concurrent Bluetooth connections
The vulnerability is tracked as CVE-2025-9994 (CVSS score 9.8), is a complete absence of authentication mechanisms. Any user who can reach the device's HTTP port through network access can immediately view and modify all administrative settings without providing any form of identity verification.
CERT/CC researchers have attempted to contact Amp'ed RF regarding this vulnerability but have not received any response from the vendor.
Given the absence of vendor-provided security updates and the no possibility of implementing authentication controls, organizations must rely on network-level security isolation to protect deployed BT-AP 111 devices.
Network administrators should implement VLAN segmentation to create isolated network segments specifically for BT-AP 111 devices. Until Amp'ed RF releases firmware updates that implement proper authentication and authorization controls, organizations operating in security-sensitive environments should strongly consider replacing BT-AP 111 devices with alternative Bluetooth access point solutions that provide adequate security controls.
