An attacker within Bluetooth Low Energy (BLE) communication range can monopolize the device’s sole available BLE connection slot, preventing legitimate users or applications from establishing a connection. The vulnerability is a missing authorization flaw (CWE‑862) that results in service disruption rather than privilege escalation or data disclosure.

Affected product: Apollo Pharmacy Blood Glucose Monitoring System, model APG‑01 BT. No specific firmware or version information is provided in the advisory.

The CVSS score of 7.1 classifies the flaw as high severity, but the EPSS score is unavailable, so the likelihood of exploitation cannot be quantified. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the attacker to be within BLE range of the device and to initiate a connection request, flooding the single connection slot and blocking legitimate traffic. Without an available patch, the risk is moderate to high for environments where the device is used in proximity to potential attackers.