UNDOCUMENTED COMMANDS FOUND IN BLUETOOTH CHIP USED BY A BILLION DEVICES

Summary from the TLDR InfoSec newsletter

Researchers from Tarlogic Security discovered 29 undocumented commands in the firmware of the ESP32 Bluetooth device. The commands could allow for memory manipulation, MAC address spoofing, and LMP/LLCP packet injection. While the commands could open the door for supply chain attacks, a more realistic threat would be a physical attacker establishing persistence and performing further attacks through the ESP32's memory.