A critical missing authentication vulnerability in the Amp’ed RF BT-AP 111 Bluetooth access point enables unauthenticated attackers to gain full administrative control over the device.

This is a critical authentication bypass flaw (CWE-306/CWE-287) where the HTTP management interface lacks any login mechanism. An unauthenticated remote attacker can access the interface without credentials.

Successful exploitation allows an attacker to gain full control of the access point. Given the CVSS score of 9.8, this represents a severe risk of network compromise, potential interception of traffic, and unauthorized configuration changes, which could lead to a complete breach of the internal network segment.

Immediate Action: As no specific patch version is listed, isolate the device from public-facing networks immediately and disable the HTTP management interface if possible.

Proactive Monitoring: Monitor network traffic for unauthorized access attempts directed at the device's management IP addresses and review all changes made to the device configuration.

Compensating Controls: Implement strict network segmentation using VLANs and place the management interface behind a VPN or firewall that restricts access to trusted management workstations only.

Public Exploit Available: No (unknown)

This vulnerability presents an extreme risk due to the absence of authentication requirements for administrative functions. Organizations using the Amp’ed RF BT-AP 111 should treat this as a high-priority incident and restrict network access to the device until an official firmware update is provided by the vendor.