Bluetooth is everywhere—from our headphones and smartwatches to our cars and home automation systems. But a recent security discovery has raised concerns about hidden commands lurking in certain Bluetooth chips. Researchers have found undocumented functions within ESP32 chip firmware, potentially exposing billions of devices to security risks. Here’s what you need to know.

The Discovery: Undocumented Bluetooth Commands

At RootedCON 2025, security researchers revealed hidden commands embedded in ESP32 chips, a widely used Bluetooth and WiFi module from Espressif. These commands were never publicly documented by the manufacturer, making them a potential backdoor. BleepingComputer also covered this alarming discovery, which affects countless IoT devices worldwide.

Why It Matters

These undocumented commands act like a hidden set of tools within the chip’s firmware. While they may have been intended for debugging or internal testing, they also create security vulnerabilities that bad actors could exploit.

Key Risks:

• Unauthorized Access:
  • A hacker could exploit the hidden commands to access a smart door lock using an ESP32 chip, unlocking doors remotely without the owner’s knowledge.
  • A cybercriminal could take control of a Bluetooth-enabled security system, disabling alarms or surveillance cameras in a home or office.
• Device Manipulation:
  • Attackers could alter the settings of a Bluetooth-connected insulin pump, delivering incorrect doses and endangering the patient’s health.
  • A hacker could remotely manipulate a smart thermostat, causing extreme temperature changes that could damage sensitive equipment or make a home uncomfortable.
• IoT Security Concerns:
  • A compromised smart home hub could allow an attacker to control multiple connected devices, such as lights, locks, and appliances.
  • Cybercriminals could hijack Bluetooth-enabled baby monitors, using them to spy on families or communicate with children.
• Supply Chain Risks:
  • A manufacturer producing Bluetooth fitness trackers might unknowingly integrate vulnerable ESP32 chips, exposing users’ health data to hackers.
  • A company using ESP32-based industrial sensors in factories could face a large-scale security breach if attackers exploit the hidden commands to disrupt operations.

What Can Be Done?

While this discovery is concerning, there are steps that manufacturers and users can take to mitigate the risk.

• Manufacturer Action: Espressif and other chip makers must investigate the issue, release security updates, and enhance transparency.
• Security Audits: Companies using ESP32 chips should conduct security audits to identify and address potential risks.
• Firmware Updates: Keeping your devices updated with the latest firmware is crucial, as manufacturers often release patches to fix vulnerabilities.
• User Awareness: Always pair Bluetooth devices with trusted sources and disable Bluetooth when not in use.
• Community Tools: Security tools like BSAM help users analyze Bluetooth security on their devices.

The Technical Side (Simplified)

For those interested in the technical details, here’s a brief overview:

• HCI (Host Controller Interface): Bluetooth devices communicate using HCI, and researchers are working on tools to analyze these interactions.
• Reverse Engineering: Security professionals are reverse-engineering the ESP32 firmware to map out the undocumented commands.
• New Attack Vectors: These hidden functions may allow for new types of Bluetooth attacks that weren’t possible before.

Final Thoughts

This discovery underscores the need for strong security practices, transparency from manufacturers, and continuous research into potential vulnerabilities. While the risks are real, a proactive approach—including security updates, user awareness, and industry collaboration—can help keep Bluetooth-enabled devices safe from exploitation.

As more details emerge, it will be crucial for manufacturers and security professionals to work together to address these risks and ensure a more secure Bluetooth ecosystem. Stay informed, stay updated, and stay secure.

BACK TO BLOGS