{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2026-31280", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-04-14T15:23:22.851Z", "dateReserved": "2026-03-09T00:00:00.000Z", "datePublished": "2026-04-13T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-04-13T20:25:10.060Z"}, "descriptions": [{"lang": "en", "value": "An issue in the Bluetooth RFCOMM service of Parani M10 Motorcycle Intercom v2.1.3 allows unauthorized attackers to cause a Denial of Service (DoS) via supplying crafted RFCOMM frames."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://nvd.nist.gov/vuln/detail/cve-2025-20701"}, {"url": "https://nvd.nist.gov/vuln/detail/cve-2023-4586"}, {"url": "https://amoebatech.gitbook.io/amoebatech-docs/cve-2026-31280-insecure-bluetooth-rfcomm-leading-to-device-crash-in-parani-m10-intercom"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-14T15:23:09.661315Z", "id": "CVE-2026-31280", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-14T15:23:22.851Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31280", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-14T15:23:09.661315Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-14T15:23:17.378Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://nvd.nist.gov/vuln/detail/cve-2025-20701"}, {"url": "https://nvd.nist.gov/vuln/detail/cve-2023-4586"}, {"url": "https://amoebatech.gitbook.io/amoebatech-docs/cve-2026-31280-insecure-bluetooth-rfcomm-leading-to-device-crash-in-parani-m10-intercom"}], "descriptions": [{"lang": "en", "value": "An issue in the Bluetooth RFCOMM service of Parani M10 Motorcycle Intercom v2.1.3 allows unauthorized attackers to cause a Denial of Service (DoS) via supplying crafted RFCOMM frames."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-04-13T20:25:10.060Z"}}}, "cveMetadata": {"cveId": "CVE-2026-31280", "state": "PUBLISHED", "dateUpdated": "2026-04-14T15:23:22.851Z", "dateReserved": "2026-03-09T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-04-13T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "An issue in the Bluetooth RFCOMM service of Parani M10 Motorcycle Intercom v2.1.3 allows unauthorized attackers to cause a Denial of Service (DoS) via supplying crafted RFCOMM frames."}], "id": "CVE-2026-31280", "lastModified": "2026-04-13T21:16:24.143", "metrics": {}, "published": "2026-04-13T21:16:24.143", "references": [{"source": "cve@mitre.org", "url": "https://amoebatech.gitbook.io/amoebatech-docs/cve-2026-31280-insecure-bluetooth-rfcomm-leading-to-device-crash-in-parani-m10-intercom"}, {"source": "cve@mitre.org", "url": "https://nvd.nist.gov/vuln/detail/cve-2023-4586"}, {"source": "cve@mitre.org", "url": "https://nvd.nist.gov/vuln/detail/cve-2025-20701"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Received"}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.1.3"}}], "enrichment": {"confidence": 85.0, "confidence_source": "inferred", "scores": [{"score": 85.0, "source": "inferred"}]}, "original": {"product": "n/a", "source": "cna", "vendor": "n/a"}, "product": "m10_motorcycle_intercom", "vendor": "parani"}], "analysis": {"en": {"generated_at": "2026-04-13T21:52:53.929858+00:00", "value": {"mitigation_remediation": ["Update the intercom firmware to the latest version that addresses the RFCOMM crash.", "If an update is unavailable, disable or block the Bluetooth RFCOMM service or restrict Bluetooth pairing to trusted devices only.", "Monitor the intercom for repeated crashes and report incidents to the vendor.", "Follow any vendor advisories or release notes closely for a fix."], "summary": {"action": "Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Parani M10 Motorcycle Intercom with firmware version\u202f2.1.3. No other vendors or products are listed in the CVE details.", "description_and_impact": "An issue in the Bluetooth RFCOMM service of the Parani M10 Motorcycle Intercom running firmware 2.1.3 permits an attacker who can transmit data over Bluetooth to send specially crafted RFCOMM frames that trigger a crash. The crash stops the intercom from functioning, effectively denying the rider the ability to communicate through the device and potentially affecting safety.", "risk_and_exploitability": "The EPSS score is not provided and the vulnerability is not included in CISA\u2019s KEV catalog, so publicly available data on exploitation frequency is lacking. The attack vector is inferred to be Bluetooth, as the description references crafted RFCOMM frames; thus an attacker would need to be in Bluetooth range to send the malicious frames. No other prerequisites or conditions are specified in the description, and the impact can be achieved solely by sending the crafted frames. The lack of an announced exploit means the immediate risk is uncertain, but devices running the vulnerable firmware remain at risk until a fix is applied."}}}}, "created": "2026-04-14T16:21:43.590963+00:00", "title": "Bluetooth RFCOMM Denial of Service in Parani M10 Intercom", "updated": "2026-04-14T16:35:34.544547+00:00", "vendors": ["parani", "parani$PRODUCT$m10_motorcycle_intercom"], "weaknesses": ["CWE-20", "CWE-119"]}