CVE-2025-67399 identifies a vulnerability in the bootloader version 1.005 of the AIRTH SMART HOME AQI MONITOR device. The root cause is the exposure of the UART (Universal Asynchronous Receiver/Transmitter) port on the BK7231N controller, which integrates Wi-Fi and BLE functionalities. This UART port is accessible without authentication, allowing an attacker physically near the device to connect and extract sensitive information directly from the bootloader. The bootloader is a critical component responsible for initializing hardware and loading the main firmware, and it may contain sensitive data such as cryptographic keys, device configuration, or debug information. The vulnerability is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The CVSS v3.1 score is 4.6 (medium severity), reflecting that the attack vector requires physical proximity (AV:P), has low attack complexity (AC:L), no privileges required (PR:N), and no user interaction (UI:N). The impact is limited to confidentiality (C:H), with no impact on integrity or availability. No patches or fixes are currently available, and no exploits have been reported in the wild. This vulnerability primarily threatens the confidentiality of sensitive data stored or accessible via the bootloader UART interface.

For European organizations, the primary impact is the potential leakage of sensitive information from AIRTH SMART HOME AQI MONITOR devices deployed in smart home or IoT environments. This could include cryptographic keys, device identifiers, or configuration data that could facilitate further attacks or unauthorized access. While the vulnerability does not directly affect device integrity or availability, the exposure of sensitive data could undermine trust in IoT deployments and lead to privacy violations or targeted attacks. Organizations relying on these devices for environmental monitoring or automation may face risks of data compromise, especially in sectors like residential services, smart buildings, or critical infrastructure monitoring. The requirement for physical proximity limits the attack scope but does not eliminate risk in shared or publicly accessible spaces. The absence of known exploits reduces immediate threat but does not preclude future exploitation.

To mitigate this vulnerability, European organizations should implement strict physical security controls to prevent unauthorized access to the devices, especially in shared or public environments. Device placement should avoid easily accessible locations. Network segmentation and monitoring should be employed to detect anomalous device behavior that might indicate tampering. If possible, disable or restrict UART port access through hardware modifications or firmware updates once available. Organizations should engage with the vendor for patches or updated firmware addressing this issue. Additionally, auditing and inventorying all AIRTH SMART HOME AQI MONITOR devices in use can help assess exposure. Employing endpoint detection solutions that monitor device interfaces may provide early warnings of physical tampering attempts. Finally, consider alternative devices with stronger physical security if risk tolerance is low.