CVE-2026-37100 describes a vulnerability in the BLE control interface of the Yamaha SR-B30A sound bar firmware 2.40 and its associated mobile app (Sound Bar Remote 2.40). The flaw allows remote attackers within BLE radio range to establish a connection without authentication via the Sound Bar Remote protocol, violating access control (CWE-284). This could allow unauthorized control of the sound bar. The vulnerability is rated medium severity with a CVSS 3.1 base score of 6.5 (Attack Vector: Adjacent, Attack Complexity: Low, Privileges Required: None, User Interaction: None, Scope: Unchanged, Confidentiality: None, Integrity: High, Availability: None). There is no vendor advisory or patch information available at this time.

The vulnerability allows an attacker within Bluetooth range to connect to the sound bar without authentication, potentially enabling unauthorized control or manipulation of the device. The impact affects the integrity of the device's operation but does not affect confidentiality or availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should limit Bluetooth exposure by disabling BLE when not in use or restricting physical proximity to trusted users. Monitor vendor communications for updates or patches addressing this issue.