Technical impact
The Bluetooth firmware of the JBL Flip 4 contains a flaw that can be triggered by malformed messages sent by an unauthenticated sender. When the receiver processes these messages, the device crashes and becomes unavailable until restarted. This results in a denial of service without compromising data integrity or confidentiality, as the vulnerability is limited to availability. The weakness is characterized by CWE-923.
Affected Systems
All JBL Flip 4 Bluetooth speakers running firmware versions earlier than 4.1.0 are impacted. No other JBL products or newer firmware versions are known to be vulnerable.
Risk and Exploitability
The CVSS score of 6.5 indicates a moderate to high severity for a remote, unauthenticated denial of service. Because the attack vector relies on proximity over Bluetooth, an attacker must be within range of the device but does not need any special privileges. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation yet. Nonetheless, the possibility of devices crashing and interrupting service warrants monitoring and patching where possible.
