Chocapikk

Uniwill Liquid Cooling (LCT21001/LCT22002) - BLE Protocol

Complete protocol documentation for the Uniwill/Clevo laptop liquid cooling units used by XMG OASIS, TUXEDO Aquaris, and other rebrands. Covers both command and response sides.

Reverse-engineered from GCUService.exe (Uniwill's backend service, .NET IL, 402k lines) by decompiling with ikdasm. This is the first public documentation of the response protocol - existing projects (watercooler-manager, TUXEDO Control Center, LPPController) only implement the command side.

BLE Connection

The cooling unit uses BLE GATT with the Nordic UART Service (NUS).

Chocapikk

CVE-2025-34152 - Active Exploitation in the Wild

Date observed: September 2025
Affected devices: Shenzhen Aitemi M300 (MT02) Wi-Fi Repeaters

1. Exploit Trigger (Captured Logs)

Evidence from /tmp/commuos.log showing remote code execution via protocol.csp.
The attacker injects a wget | sh payload in the time parameter.

Chocapikk

$ wpprobe search --severity critical --auth Unauth --cve "CVE-2025" -d                                                                         4:35:19 AM

 __    __  ___  ___           _
/ / /\ \ \/ _ \/ _ \_ __ ___ | |__   ___
\ \/  \/ / /_)/ /_)/ '__/ _ \| '_ \ / _ \
 \  /\  / ___/ ___/| | | (_) | |_) |  __/
  \/  \/\/   \/    |_|  \___/|_.__/ \___|
                                   v0.7.0 [latest]