CVE-2025-36755

The CleverDisplay BlueOne hardware player is designed with its USB interfaces physically enclosed and inaccessible under normal operating conditions. Researchers demonstrated that, after cicumventing the device’s protective enclosure, it was possible to connect a USB keyboard and press ESC during boot to access the BIOS setup interface. BIOS settings could be viewed but not modified. This behavior slightly increases the attack surface by exposing internal system information (CWE-1244) once the enclosure is removed, but does not allow integrity or availability compromise under standard or tested configurations.

CVSS

No CVSS.

References

Link	Resource
https://csirt.divd.nl/CVE-2025-5743/
https://csirt.divd.nl/DIVD-2025-00043

Configurations

No configuration.

History

07 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) El reproductor de hardware CleverDisplay BlueOne está diseñado con sus interfaces USB físicamente encerradas e inaccesibles en condiciones normales de funcionamiento. Los investigadores demostraron que, después de eludir la carcasa protectora del dispositivo, era posible conectar un teclado USB y pulsar ESC durante el arranque para acceder a la interfaz de configuración de la BIOS. La configuración de la BIOS podía verse pero no modificarse. Este comportamiento aumenta ligeramente la superficie de ataque al exponer información interna del sistema (CWE-1244) una vez retirada la carcasa, pero no permite el compromiso de la integridad o la disponibilidad en configuraciones estándar o probadas.

Information

Published : 2025-12-12 15:15

Updated : 2026-10-07 20:10

NVD link : CVE-2025-36755

Mitre link : CVE-2025-36755

CVE.ORG link : CVE-2025-36755

JSON object : View

Products Affected

No product.

CWE

CWE-1191

On-Chip Debug and Test Interface With Improper Access Control

CWE-1244

Internal Asset Exposed to Unsafe Debug Access Level or State

{"id": "CVE-2025-36755", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-36755", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-12T18:50:02.532239Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "csirt@divd.nl", "cvssData": {"Safety": "NEGLIGIBLE", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.4, "Automatable": "NO", "attackVector": "PHYSICAL", "baseSeverity": "LOW", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:X/V:D/RE:L/U:Green", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "GREEN", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "LOW", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "csirt@divd.nl", "affectedData": [{"vendor": "CleverDisplay B.V.", "modules": ["Enclosure / USB keyboard interface / BIOS & GRUB boot process"], "product": "BlueOne (CleverDisplay Hardware Player)", "versions": [{"status": "affected", "version": "12.11.1", "versionType": "semver"}, {"status": "unaffected", "version": "12.12.1", "versionType": "semver", "lessThanOrEqual": "*"}], "defaultStatus": "unknown"}]}], "published": "2025-12-12T15:15:53.433", "references": [{"url": "https://csirt.divd.nl/CVE-2025-5743/", "source": "csirt@divd.nl"}, {"url": "https://csirt.divd.nl/DIVD-2025-00043", "source": "csirt@divd.nl"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "csirt@divd.nl", "description": [{"lang": "en", "value": "CWE-1191"}, {"lang": "en", "value": "CWE-1244"}]}], "descriptions": [{"lang": "en", "value": "The CleverDisplay BlueOne hardware player is designed with its USB interfaces physically enclosed and inaccessible under normal operating conditions. Researchers demonstrated that, after cicumventing the device\u2019s protective enclosure, it was possible to connect a USB keyboard and press ESC during boot to access the BIOS setup interface. BIOS settings could be viewed but not modified. This behavior slightly increases the attack surface by exposing internal system information (CWE-1244) once the enclosure is removed, but does not allow integrity or availability compromise under standard or tested configurations."}, {"lang": "es", "value": "El reproductor de hardware CleverDisplay BlueOne est\u00e1 dise\u00f1ado con sus interfaces USB f\u00edsicamente encerradas e inaccesibles en condiciones normales de funcionamiento. Los investigadores demostraron que, despu\u00e9s de eludir la carcasa protectora del dispositivo, era posible conectar un teclado USB y pulsar ESC durante el arranque para acceder a la interfaz de configuraci\u00f3n de la BIOS. La configuraci\u00f3n de la BIOS pod\u00eda verse pero no modificarse. Este comportamiento aumenta ligeramente la superficie de ataque al exponer informaci\u00f3n interna del sistema (CWE-1244) una vez retirada la carcasa, pero no permite el compromiso de la integridad o la disponibilidad en configuraciones est\u00e1ndar o probadas."}], "lastModified": "2026-10-07T20:10:01.970", "sourceIdentifier": "csirt@divd.nl"}