CVE-2025-4994

The SafeLine SL6 and SL6+ devices integrated into elevator emergency intercom systems are vulnerable to an authentication bypass. This vulnerability allows attackers to bypass authentication requirements and access the device's configuration service via the Bluetooth Low Energy (BLE) interface. Consequently, an attacker within wireless range can gain unauthorized administrative access to the device configuration.

CVSS

No CVSS.

References

Link	Resource
https://www.schutzwerk.com/en/blog/schutzwerk-sa-2025-001/
http://seclists.org/fulldisclosure/2026/Jul/17

Configurations

No configuration.

History

30 Sep 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Los dispositivos SafeLine SL6 y SL6+ integrados en sistemas de intercomunicación de emergencia de ascensores son vulnerables a una omisión de autenticación. Esta vulnerabilidad permite a los atacantes omitir los requisitos de autenticación y acceder al servicio de configuración del dispositivo a través de la interfaz Bluetooth de Baja Energía (BLE). En consecuencia, un atacante dentro del alcance inalámbrico puede obtener acceso administrativo no autorizado a la configuración del dispositivo.

Information

Published : 2026-06-22 10:16

Updated : 2026-10-06 22:10

NVD link : CVE-2025-4994

Mitre link : CVE-2025-4994

CVE.ORG link : CVE-2025-4994

JSON object : View

Products Affected

No product.

CWE

CWE-305

Authentication Bypass by Primary Weakness

{"id": "CVE-2025-4994", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-4994", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-22T12:25:04.852373Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "23637b5d-af4c-4cf9-b8f6-deb7fd0f8423", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "23637b5d-af4c-4cf9-b8f6-deb7fd0f8423", "affectedData": [{"vendor": "SafeLine", "product": "SafeLine SL6/SL6+", "versions": [{"status": "affected", "version": "4.82", "lessThan": "4.97", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-22T10:16:17.673", "references": [{"url": "https://www.schutzwerk.com/en/blog/schutzwerk-sa-2025-001/", "source": "23637b5d-af4c-4cf9-b8f6-deb7fd0f8423"}, {"url": "http://seclists.org/fulldisclosure/2026/Jul/17", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "23637b5d-af4c-4cf9-b8f6-deb7fd0f8423", "description": [{"lang": "en", "value": "CWE-305"}]}], "descriptions": [{"lang": "en", "value": "The SafeLine SL6 and SL6+ devices integrated into elevator emergency intercom systems are vulnerable to an authentication bypass. This vulnerability allows attackers to bypass authentication requirements and access the device's configuration service via the Bluetooth Low Energy (BLE) interface. Consequently, an attacker within wireless range can gain unauthorized administrative access to the device configuration."}, {"lang": "es", "value": "Los dispositivos SafeLine SL6 y SL6+ integrados en sistemas de intercomunicaci\u00f3n de emergencia de ascensores son vulnerables a una omisi\u00f3n de autenticaci\u00f3n. Esta vulnerabilidad permite a los atacantes omitir los requisitos de autenticaci\u00f3n y acceder al servicio de configuraci\u00f3n del dispositivo a trav\u00e9s de la interfaz Bluetooth de Baja Energ\u00eda (BLE). En consecuencia, un atacante dentro del alcance inal\u00e1mbrico puede obtener acceso administrativo no autorizado a la configuraci\u00f3n del dispositivo."}], "lastModified": "2026-10-06T22:10:00.247", "sourceIdentifier": "23637b5d-af4c-4cf9-b8f6-deb7fd0f8423"}