Researchers from Tarlogic Security have discovered undocumented commands in the widely used ESP32 microchip, manufactured by Espressif, which could act as a backdoor for cyberattacks on millions of IoT devices. Presented at RootedCON, their findings reveal that these hidden commands allow attackers to impersonate trusted devices, manipulate memory, access sensitive data, establish long-term persistence, and potentially grant access to other devices via Bluetooth. Using their newly developed BluetoothUSB tool, the researchers identified twenty-nine (29) undocumented HCI commands (code 0x3F) in the ESP32 Bluetooth firmware, which enable low-level control over Bluetooth functions, including RAM and Flash modification, MAC address spoofing, and LMP/LLCP packet injection. The vulnerability, now tracked as CVE-2025-27840, raises concerns about potential supply chain attacks and OEM-level exploitation. While the researchers clarify that these commands are more accurately described as a “hidden feature” rather than a deliberate backdoor, their existence poses a significant security risk, especially if attackers gain root access or exploit vulnerable firmware. Given that over a billion ESP32 chips are in circulation, affecting devices such as smartphones, smart locks, and medical equipment, the implications are vast. Tarlogic aims to democratize Bluetooth security testing with their BluetoothUSB tool, helping manufacturers identify and mitigate such vulnerabilities. Espressif has yet to comment on these findings, while further technical details are expected to be released in the coming weeks. CTIX analysts will continue to monitor this situation, and may release updates in future issues of the CTIX FLASH Update.