CVE-2025-4994 is an authentication bypass vulnerability (CWE-305) affecting SafeLine SL6 and SL6+ devices used in elevator emergency intercom systems. The vulnerability allows an attacker within BLE wireless range to bypass authentication controls and access the device's configuration service, potentially enabling unauthorized administrative actions. The affected version is 4.82. The CVSS 4.0 vector indicates the attack requires adjacent network access (Bluetooth), has low complexity, no privileges or user interaction required, and results in high impact on confidentiality, integrity, and availability. No vendor advisory or patch is currently available, and no known exploits are reported in the wild.

An attacker within Bluetooth range can bypass authentication and gain administrative access to the device configuration. This could allow unauthorized changes to device settings, potentially disrupting emergency communication functionality or compromising device security. The vulnerability impacts confidentiality, integrity, and availability of the device configuration.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit physical and wireless access to the affected devices to trusted personnel only. Monitor for any vendor updates or security advisories regarding this vulnerability.