PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-31280 Amoebatech CVE debrief

CVE-2026-31280 is a Bluetooth availability issue affecting the Parani M10 Motorcycle Intercom v2.1.3. According to the supplied corpus, an unauthorized attacker can supply crafted RFCOMM frames to the Bluetooth RFCOMM service and cause a denial of service. The recorded CVSS vector indicates an adjacent-network attack with no privileges or user interaction required, and the impact is limited to availability. The source record is marked Deferred in NVD, and the vendor attribution in the corpus is low-confidence and flagged for review.

Vendor
Amoebatech
Product
Parani M10 Motorcycle Intercom
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-13
Original CVE updated
2026-05-10
Advisory published
2026-04-13
Advisory updated
2026-05-10

Who should care

Organizations and individuals using the Parani M10 Motorcycle Intercom v2.1.3, especially where Bluetooth availability matters or devices are deployed in environments where nearby wireless attacks are plausible.

Technical summary

The corpus describes a Bluetooth RFCOMM service issue that can be triggered by crafted RFCOMM frames, resulting in device or service crash/DoS behavior. NVD lists the issue as CVSS 3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating an adjacent attacker can impact availability without credentials or user interaction.

Defensive priority

Medium. Prioritize remediation if the device is operationally critical, routinely exposed to Bluetooth traffic, or cannot be closely controlled in the field.

Recommended defensive actions

  • Confirm whether any firmware update or vendor remediation is available for Parani M10 Motorcycle Intercom v2.1.3.
  • Reduce Bluetooth exposure where possible, including disabling Bluetooth or RFCOMM features when they are not required.
  • Limit use to trusted, controlled environments and review pairing/access policies for nearby wireless access.
  • Monitor for unexpected crashes or service interruptions that could indicate exploitation attempts.
  • Track the NVD and vendor advisory pages for status changes, clarifications, or remediation guidance.

Evidence notes

The supplied description states that unauthorized attackers can cause a DoS by supplying crafted RFCOMM frames to the Bluetooth RFCOMM service in Parani M10 Motorcycle Intercom v2.1.3. The NVD metadata lists CVSS 3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H and vulnStatus Deferred. The source references include an Amoebatech GitBook advisory page and two additional NVD CVE detail pages referenced by the record (CVE-2023-4586 and CVE-2025-20701). No exploit code, patch details, or confirmed remediation guidance were included in the supplied corpus.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-31280 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-31280

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-31280 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-31280

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.