ESP32 and the Security Risk of Hidden Commands
A team of security researchers has discovered undocumented commands in the ESP32 chip, one of the most widely used chips in IoT devices worldwide. According to the experts, these special commands could be exploited to access a device's memory and manipulate Bluetooth functions, creating a potential risk to system security. However, exploiting them remotely is not simple and typically requires physical access or previously compromised software.
The ESP32 chip, made by Espressif (China), is a key component in mobile devices, computers, smart locks and medical devices, and supports both Wi-Fi and Bluetooth connectivity. By one count, as of 2023 more than 1 billion devices worldwide were using the ESP32.
The finding was presented by two Spanish security researchers, Miguel Tarascó Acuña and Antonio Vázquez Blanco of Tarlogic Security, at the RootedCON conference in Madrid. The team identified 29 proprietary commands hidden in the ESP32's Bluetooth firmware, including Opcode 0x3F, which allow low-level control over Bluetooth functions.
Although it was initially labeled a "backdoor," the researchers later clarified that these commands are in fact hidden features that can be used to read and modify memory on the ESP32 chip. Still, their existence continues to raise concerns about supply chain attacks and the possibility of backdoors being planted by original equipment manufacturers (OEMs).
Security Risks and How They Could Be Exploited
These undocumented commands could be abused to read and write RAM and Flash memory, change the MAC address to spoof a device, or inject LMP/LLCP packets. While the features themselves are not malicious, in an attacker's hands they could be used to impersonate devices, bypass security checks or permanently alter a device's behavior.
A unique tool to audit the security of the Bluetooth standard on any IoT device. Miguel Tarascó and @antonvblanco are presenting #BluetoothUSB at @rootedcon. pic.twitter.com/hsCFCWOCuB
- Tarlogic (@Tarlogic) March 6, 2025
How dangerous these commands are depends mainly on the method of attack. In most cases, remote exploitation requires another security vulnerability to go along with it, such as pre-installed malware or tampered firmware. A more realistic attack scenario would involve an attacker with physical access to the device's USB or UART port, who could then manipulate it directly.
To analyze the chip and uncover these hidden commands, the Tarlogic team developed BluetoothUSB, a new C-based Bluetooth driver that retrieves Bluetooth data without depending on operating system APIs. The tool allows comprehensive security testing of Bluetooth devices without specialized hardware, overcoming the weakness of traditional security tools, which are limited by the operating system.
Given how widespread the ESP32 is in low-cost IoT devices (some costing as little as 2 USD), the discovery is an important reminder of how much firmware security matters. Although these hidden commands may originally have been designed to support debugging and development, their existence poses a major challenge for IoT system security going forward.
