An issue in the Bluetooth RFCOMM service of the Parani M10 Motorcycle Intercom running firmware 2.1.3 permits an attacker who can transmit data over Bluetooth to send specially crafted RFCOMM frames that trigger a crash. The crash stops the intercom from functioning, effectively denying the rider the ability to communicate through the device and potentially affecting safety. The crash is caused by buffer overflow conditions (CWE-120) in the RFCOMM frame parsing, allowing an attacker to exploit this weakness to cause the denial of service.

The vulnerability affects the Parani M10 Motorcycle Intercom with firmware version 2.1.3. No other vendors or products are listed in the CVE details.

The EPSS score is < 1% and the CVSS score is 6.5, while the vulnerability is not included in CISA’s KEV catalog, indicating a very low exploitation probability. The attack vector is inferred to be Bluetooth, as the description references crafted RFCOMM frames; thus an attacker would need to be in Bluetooth range to send the malicious frames. No other prerequisites or conditions are specified in the description, and the impact can be achieved solely by sending the crafted frames. The lack of an announced exploit means the immediate risk is uncertain, but devices running the vulnerable firmware remain at risk until a fix is applied.