JBL TUNE FLEX vulnerabilities

Latest JBL TUNE FLEX CVEs

Newest publication first

1. CVE-2024-2104 JBL: Improper BLE security configurations and lack of authentication on the device's GATT server

   Published 2025-12-10

   High·CVSS 8.8 EPSS 0.25%

   Due to improper BLE security configurations on the device's GATT server, an adjacent unauthenticated attacker can read and write device control commands through the mobile app service wich could render the device unusable.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.