What is the new PerfektBlue Bluetooth vulnerability affecting vehicles globally in 2025?

The automotive industry faces a new high-risk cybersecurity threat in 2025. A sophisticated attack chain named PerfektBlue has been uncovered, exploiting critical vulnerabilities in OpenSynergy’s BlueSDK Bluetooth framework. This blog provides a structured breakdown of what’s happening, which vehicles are affected, and what organizations and individuals should do next — written according to the Google AI Overview format for clear, structured insights.

What Is PerfektBlue Attack?

PerfektBlue is a Bluetooth-based Remote Code Execution (RCE) exploit chain targeting automotive infotainment systems. It leverages four chained vulnerabilities in BlueSDK, a widely used Bluetooth protocol stack, allowing attackers to gain unauthorized control over in-vehicle systems.

• First reported: July 2025

  
  

• Primary target: Mercedes-Benz, Volkswagen, Škoda vehicles

• Affected systems: Infotainment systems (IVI), with possible lateral movement to vehicle ECUs

How PerfektBlue Works: Technical Overview

PerfektBlue combines memory corruption and logical vulnerabilities in Bluetooth stack protocols:

• AVRCP (Audio/Video Remote Control Profile)

• L2CAP (Logical Link Control and Adaptation Protocol)

  
  

• RFCOMM (Radio Frequency Communication)

The attack requires establishing a Bluetooth connection and possibly a pairing process. Once connected, attackers can remotely exploit these vulnerabilities without user awareness, often requiring just a single click from the victim.

Vulnerabilities in Detail (With CVE IDs and CVSS Scores)

Confirmed Vehicle Models Affected

• Mercedes-Benz NTG6/NTG7 head units

• Volkswagen MEB ICAS3 (ID.4 model line)

• Škoda MIB3 head units (Superb model line)

Attackers can potentially access:

• GPS data

• Audio recordings

• Personal user data

• Vehicle control interfaces (ECU lateral movement risk)

Real-World Impact: Why This Matters

Even though OpenSynergy released fixes in September 2024, supply chain complexities delayed patches until as late as June 2025 for some manufacturers. This lag exposes millions of vehicles worldwide to remote hacking risks.

Notably:

• Infotainment systems often hold personal information like contact lists and navigation history.

• If attackers move laterally, they may reach more sensitive vehicle systems beyond infotainment.

Exploit Chain Breakdown: Step-by-Step

1. Initial Bluetooth Connection: Attacker pairs with the target system.

2. RFCOMM Exploitation: Manipulation of protocol termination and function parameters.

3. L2CAP Exploitation: Bypassing security checks with incorrect channel identifiers.

4. AVRCP Use-After-Free: Final stage where attackers gain remote code execution privileges.

The attack chain uses minimal user interaction and doesn’t require authentication or prior system compromise.

Mitigation Strategies for Organizations and Users

Firmware Updates

• Patch immediately using vendor-released updates:

  • SQL Server 2022 → KB 5058721

  • SQL Server 2019 → KB 5058722

  • SQL Server 2017 → KB 5058714
    (For infotainment systems, check manufacturer-specific updates.)

Disable Bluetooth if Not Essential

• Especially in high-risk environments (government, corporate fleets).

Network Segmentation

• Ensure that IVI systems are isolated from mission-critical vehicle control networks.

Manufacturer Actions

• Prioritize vulnerability scanning in Bluetooth stack implementations.

• Strengthen vulnerability disclosure processes with supply chain partners.

Lessons for Automotive Cybersecurity in 2025

• Supply chain patch delays remain a critical weak link in automotive security.

• Infotainment systems now represent a real attack surface with privacy and safety risks.

• Manufacturers must enforce zero-trust principles even within vehicle architectures.

PerfektBlue Key Facts

Conclusion

PerfektBlue underlines how even non-critical vehicle systems can pose significant cybersecurity risks. Bluetooth stacks—long considered low-priority—are now frontline targets for attackers.

For automotive companies, proactive threat modeling, rapid patching workflows, and security validation at every layer of development are non-negotiable in today’s cyber landscape.

FAQs

What is the PerfektBlue attack in the automotive industry?

PerfektBlue is a 2025-disclosed Bluetooth vulnerability chain that enables remote code execution on vehicle infotainment systems using OpenSynergy’s BlueSDK.

Which car brands are affected by the PerfektBlue vulnerability?

Mercedes-Benz, Volkswagen, and Škoda are confirmed to be affected as of July 2025.

What are the CVE IDs related to the PerfektBlue attack?

CVE-2024-45434, CVE-2024-45431, CVE-2024-45433, and CVE-2024-45432.

How does the PerfektBlue attack work?

Attackers chain four Bluetooth protocol vulnerabilities allowing them to execute code remotely by exploiting memory corruption and logic flaws.

Can attackers control vehicles through PerfektBlue?

While direct vehicle control is not confirmed, attackers can access infotainment systems and possibly move laterally to critical ECUs.

What is OpenSynergy’s BlueSDK?

BlueSDK is a Bluetooth protocol stack used in various automotive infotainment systems to handle Bluetooth communication.

What is CVE-2024-45434?

A Use-After-Free vulnerability in BlueSDK’s AVRCP service allowing critical memory corruption leading to remote code execution.

What is CVE-2024-45431?

Improper L2CAP channel validation that could bypass some security mechanisms.

When were the PerfektBlue patches released?

OpenSynergy released fixes in September 2024, but full patch deployment across manufacturers was delayed until June 2025.

How severe is the PerfektBlue vulnerability?

CVE-2024-45434 is rated 8.0 (Critical), making it a high-priority vulnerability for the automotive industry.

How can drivers protect themselves from PerfektBlue?

Update the vehicle’s infotainment system firmware, disable Bluetooth when not in use, and follow manufacturer security advisories.

Are infotainment systems safe now from PerfektBlue?

Only if the latest patches have been applied. Some vehicles were unpatched until mid-2025.

What types of data can attackers access through PerfektBlue?

GPS locations, audio recordings, contact lists, and possibly sensitive system files.

Is PerfektBlue a zero-click vulnerability?

No, it typically requires establishing a Bluetooth connection, possibly involving user pairing interaction.

What does RCE mean in automotive cybersecurity?

Remote Code Execution (RCE) allows attackers to run arbitrary code on a target device without physical access.

Why was patch deployment delayed for PerfektBlue?

Automotive supply chain complexity and delayed coordination between vendors and manufacturers.

Which vehicle models are confirmed vulnerable?

Mercedes-Benz NTG6/NTG7, Volkswagen ID.4 infotainment systems, Škoda Superb MIB3 head units.

Can attackers use PerfektBlue without pairing?

It depends on system configuration. Some setups require pairing, others may not due to misconfigurations.

Is PerfektBlue linked to a specific country or cyber group?

No public attribution has been made as of July 2025.

Can Bluetooth vulnerabilities like PerfektBlue affect other devices?

Potentially yes, but this specific chain targets vehicle infotainment systems.

What is lateral movement in car hacking?

Moving from infotainment systems to more sensitive vehicle controls or ECUs after initial access.

How should manufacturers handle future Bluetooth vulnerabilities?

Implement strict vulnerability disclosure processes, security validation, and faster patch rollouts.

Is disabling Bluetooth enough to stop PerfektBlue?

Disabling Bluetooth removes the primary attack vector, significantly reducing risk.

What is AVRCP in Bluetooth?

A Bluetooth profile used for controlling audio/video devices, one of the exploited layers in PerfektBlue.

What is L2CAP in Bluetooth communication?

A protocol that handles data packets between devices; it was improperly validated in CVE-2024-45431.

What is RFCOMM in Bluetooth communication?

A protocol used for emulating serial ports, involved in two of the PerfektBlue vulnerabilities.

Can regular Bluetooth devices like headphones be affected?

No, PerfektBlue specifically targets automotive systems using OpenSynergy’s BlueSDK.

How important is network segmentation in vehicle cybersecurity?

Critical. It helps isolate infotainment systems from essential control units in case of compromise.

How often should car firmware be updated?

Regularly, especially when critical vulnerabilities like PerfektBlue are disclosed.

Are car cybersecurity attacks increasing in 2025?

Yes, as vehicles become more connected, attack surfaces like infotainment systems and Bluetooth stacks are increasingly targeted.