CVE-2024-34268 affects the EQ-3 Eqiva CC-RT-BLE Bluetooth Smart Radiator Thermostat firmware up to version 1.46. The vulnerability arises from the device allowing unsecured Bluetooth connections, which permits attackers to connect and gain full control over the device without any authentication mechanism. This could lead to unauthorized manipulation of the thermostat. The CVSS 3.1 vector indicates the attack requires low attack complexity, remote access via adjacent network (Bluetooth), no privileges required, no user interaction, and impacts integrity with limited availability impact. No vendor advisory or patch information is available at this time.

An attacker can gain full unauthorized access to the thermostat device via Bluetooth without authentication. This compromises the integrity of the device, allowing malicious control or manipulation. Confidentiality is not impacted, and availability impact is limited. The vulnerability could be exploited remotely within Bluetooth range.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling Bluetooth connectivity on the device if possible or restricting physical access to prevent unauthorized Bluetooth connections.