WPair — CVE-2025-36911 (WhisperPair) Vulnerability Scanner &...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://github.com/zalexdev/wpair-app
• Blog Title: WPair — CVE-2025-36911 (WhisperPair) Vulnerability Scanner & Research Tool
• Suggested Section: Mobile Pentesting (Android) -> add a new subsection like "Bluetooth / BLE Attacks" or extend an existing Bluetooth-related page; alternatively Generic Hacking -> Wireless/Bluetooth attacks (if such a section exists outside SUMMARY). Include: Fast Pair UUID 0xFE2C discovery, Key-Based Pairing signature-bypass probing, BLE->BR/EDR pivot, HFP/SCO post-pair abuse.

🎯 Content Summary

Title/Project: WPair — “CVE-2025-36911 (eg WhisperPair) Vulnerability Scanner & Research Tool” (Android/Kotlin app).

What this repo is: A defensive security research Android application (Kotlin) intended for authorized testing that can:

• Scan for nearby Google Fast Pair-capable Bluetooth audio devices via BLE.
• Perform a non-invasive vulnerabil...

  🔧 Technical Details

  Fast Pair device discovery via BLE service UUID (0xFE2C): Identify Google Fast Pair-capable devices by scanning BLE advertisements for the Fast Pair service UUID 0xFE2C. Any device advertising this UUID can be treated as a candidate for deeper Fast Pair GATT interactions (e.g., connecting over GATT and reading identifying fields like the Model ID).

  
  

  Non-invasive vulnerability detection by probing Key-Based Pairing signature enforcement: After a GATT connection is established and the device’s Model ID is read, attempt a Key-Based Pairing write/operation explicitly described as “no signature”. If the device accepts the unsigned operation, classify it as vulnerable to CVE-2025-36911; if rejected, treat as patched; if device state prevents a reliable probe (e.g., already paired), report the result as inconclusive.

  
  

  BLE→BR/EDR pivot by extracting the class...

  🤖 Agent Actions

  Summary:

  • Added a Fast Pair (0xFE2C) Key-Based Pairing signature-bypass section detailing discovery, unsigned KBP probing, BLE→BR/EDR pivot, HFP/SCO microphone abuse, and detection cues.
  • Updated BLE pentesting references to include the WPair WhisperPair research tool.

  Files Modified:

  • src/todo/radio-hacking/pentesting-ble-bluetooth-low-energy.md

  ---

  This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://github.com/zalexdev/wpair-app

Content Categories: Based on the analysis, this content was categorized under "Mobile Pentesting (Android) -> add a new subsection like "Bluetooth / BLE Attacks" or extend an existing Bluetooth-related page; alternatively Generic Hacking -> Wireless/Bluetooth attacks (if such a section exists outside SUMMARY). Include: Fast Pair UUID 0xFE2C discovery, Key-Based Pairing signature-bypass probing, BLE->BR/EDR pivot, HFP/SCO post-pair abuse.".

Repository Maintenance:

• MD Files Formatting: 939 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0