Skip to main content

VU#763183: Amp'ed RF BT-AP 111 Bluetooth access point lacks an authentication mechanism

Source Decision Insights Threat Desk Published November 11, 2025 Companies 3
Human View Machine View

3 companies named across 11 categories, one of 7 articles referencing Access Point. Previous coverage: Netskope's Universal ZTNA for Modern Secure Access (Oct 2025).

Companies mentioned

Best suited for

Persona
Security Operations Leader
Decision stage
Which to buy
Adoption curve
Late Majority

Our classification, not the publisher's statement. Best suited for, not only for.

Overview

The Automatic Mixed Precision (AMP)’ed RF BT-AP 111 Bluetooth Access Point (AP) exposes an HTTP-based administrative interface without authentication controls. This allows an unauthenticated remote attacker to gain full administrative access to the device.

Description

The AMP’ed RF BT-AP 111 is a Bluetooth-to-Ethernet bridge that can function as an AP or a Bluetooth gateway. According to the vendor’s website, the device supports Universal Plug and Play (UPnP) on the Ethernet side and acts as a UART Serial device to support up to seven simultaneous Bluetooth connections.

The BT-AP 111 provides a web-based administrative interface over Hypertext Transfer Protocol (HTTP). However, this interface does not implement any authentication mechanism. As a result, any user with network access to the device’s HTTP port can view and modify the administrative interface. An attacker with such access can alter Bluetooth configurations, network parameters, and other security-related settings.

According to NIST guidance, authentication is an expected baseline security control even for near-field or Bluetooth devices. The NIST Guide to Bluetooth Security (SP 800-121 Rev. 2), defines security levels that require at least authentication (Service Level 2) and preferably authentication and authorization (Service Level 1). More broadly, NIST SP 800-124 Rev. 1 emphasizes that devices should enforce authentication before granting access to configuration or administrative resources. The absence of authentication on the BT-AP 111 administrative web interface is therefore inconsistent with established best practices.

Impact

An attacker with network access (local or remote) to the web interface can gain full administrative control of the device and modify any settings exposed through the interface.

Solution

At this time, CERT/CC has not received a response from the vendor regarding this vulnerability. Since the device cannot be secured with authentication or any access controls, it is recommended that any deployments be restricted to isolated networks that are inaccessible to untrusted users.

Acknowledgements

Thanks to the reporter, Souvik Kandar. This document was written by Timur Snoke.

Vendor Information

One or more vendors are listed for this advisory. Please reference the full report for more information.

References

Other Information

Common Vulnerabilities and Exposures (CVE) Intrusion Detection System (IDS): CVE-2025-9994
Date Public: 2025-09-09
Date First Published: 2025-09-09
Date Last Updated: 2025-09-09 12:59 UTC
Document Revision: 1

Blog post, originally published at kb.cert.org.

Mentions

Structured data (JSON-LD)

The schema.org markup this page publishes for search engines and AI agents, exactly as they read it.

[
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#website",
    "@type": "WebSite",
    "name": "Decision Insights",
    "potentialAction": {
      "@type": "SearchAction",
      "target": {
        "@type": "EntryPoint",
        "urlTemplate": "https://decisioninsights.ai/search/?q={search_term_string}&submit=1"
      }
    },
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    },
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#organization",
    "@type": "Organization",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "customer support",
      "email": "[email protected]"
    },
    "description": "Decision Insights is a Registry of technology companies, open source projects, and industry terms, built for people and for AI agents that need sourced, structured information.",
    "logo": {
      "@type": "ImageObject",
      "url": "https://wiretap-cdn-assets.nyc3.cdn.digitaloceanspaces.com/decision-insights/[email protected]"
    },
    "name": "Decision Insights",
    "parentOrganization": {
      "@type": "Organization",
      "name": "Wiretap Labs",
      "sameAs": [
        "https://www.linkedin.com/company/wiretap-labs",
        "https://www.crunchbase.com/organization/wiretap-labs"
      ],
      "url": "https://wiretaplabs.com"
    },
    "publishingPrinciples": "https://decisioninsights.ai/standards/",
    "sameAs": [
      "https://www.linkedin.com/company/decisioninsights"
    ],
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai",
        "name": "Decision Insights",
        "position": 1
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/records/",
        "name": "Records",
        "position": 2
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/vu763183-amped-rf-bt-ap-111-bluetooth-access-point-lacks-an-authentication-mechanism/",
        "name": "VU#763183: Amp'ed RF BT-AP 111 Bluetooth access point lacks an authentication mechanism",
        "position": 3
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/vu763183-amped-rf-bt-ap-111-bluetooth-access-point-lacks-an-authentication-mechanism/#blogposting",
    "@type": "BlogPosting",
    "about": {
      "@id": "https://decisioninsights.ai/registry/access-point/#organization",
      "@type": "Organization",
      "mainEntityOfPage": "https://decisioninsights.ai/registry/access-point/",
      "name": "Access Point"
    },
    "articleSection": [
      "Cybersecurity",
      "AI infrastructure",
      "Network Operator"
    ],
    "audience": [
      {
        "@type": "Audience",
        "additionalType": "Persona",
        "audienceType": "Security Operations Leader"
      },
      {
        "@type": "Audience",
        "additionalType": "Adoption curve",
        "audienceType": "Late Majority"
      }
    ],
    "author": {
      "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
      "@type": "Person",
      "name": "Decision Insights Threat Desk",
      "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
    },
    "dateModified": "2026-08-23T13:05:48-06:00",
    "datePublished": "2025-11-11T12:04:27-07:00",
    "description": "Amp'ed RF BT-AP 111 Bluetooth access point exposes an unsecured HTTP admin interface, enabling unauthorized access.",
    "headline": "VU#763183: Amp'ed RF BT-AP 111 Bluetooth access point lacks an authentication mechanism",
    "isBasedOn": {
      "@type": "CreativeWork",
      "sourceOrganization": {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/",
        "name": "Department of Homeland Security"
      },
      "url": "https://kb.cert.org/vuls/id/763183"
    },
    "keywords": [
      "Access Point",
      "Authentication",
      "Automatic Mixed Precision",
      "Bluetooth",
      "Common Vulnerabilities and Exposures",
      "Intrusion Detection System",
      "Universal Plug and Play",
      "Vulnerabilities"
    ],
    "mainEntityOfPage": {
      "@id": "https://decisioninsights.ai/vu763183-amped-rf-bt-ap-111-bluetooth-access-point-lacks-an-authentication-mechanism/",
      "@type": "WebPage",
      "sdDatePublished": "2026-08-23",
      "sdPublisher": {
        "@id": "https://decisioninsights.ai/#organization"
      }
    },
    "mentions": [
      {
        "@id": "https://decisioninsights.ai/registry/access-point/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/access-point/",
        "name": "Access Point"
      },
      {
        "@id": "https://decisioninsights.ai/registry/united-states-department-of-commerce/national-institute-of-standards-and-technology-nist/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/united-states-department-of-commerce/national-institute-of-standards-and-technology-nist/",
        "name": "National Institute of Standards and Technology (NIST)"
      },
      {
        "@id": "https://decisioninsights.ai/registry/rev/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/rev/",
        "name": "REV"
      }
    ],
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    }
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
    "@type": "Person",
    "description": "CISA advisories, vendor security bulletins, and CVE disclosures, summarized into sourced briefs. Produced under our Standards & Methodology.",
    "name": "Decision Insights Threat Desk",
    "sameAs": [
      "https://www.linkedin.com/showcase/decisioninsights/"
    ],
    "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
  }
]

Is this your company? Get structured data for your own pages