CVE-2020-10135

CVSS v3.1 5.4 (Medium)

CVSS v2.0 4.8 (Medium)

EPSS 0.12 % (47^th)

Affected Products 2

Advisories 24

Legacy pairing and secure-connections pairing authentication in Bluetooth BR/EDR Core Specification v5.2 and earlier may allow an unauthenticated user to complete authentication without pairing credentials via adjacent access. An unauthenticated, adjacent attacker could impersonate a Bluetooth BR/EDR master or slave to pair with a previously paired remote device to successfully complete the authentication procedure without knowing the link key.

Weaknesses

CWE-290: Authentication Bypass by Spoofing
CWE-757: Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')

CVE Status: PUBLISHED
CNA: CERT/CC
Published Date: 2020-05-19 16:15:11
(4 years ago)
Updated Date: 2021-12-21 12:42:21
(2 years ago)

Affected Products

Bluetooth

Bluetooth Core

Opensuse

Leap

Configuration #1

		CPE23	From	Up To
	Bluetooth Core 5.2 and prior versions	cpe:2.3:a:bluetooth:bluetooth_core::::*:br		<= 5.2
	Bluetooth Core 5.2 and prior versions	cpe:2.3:a:bluetooth:bluetooth_core::::*:edr		<= 5.2

Configuration #2

		CPE23	From	Up To
	Opensuse Leap 15.1	cpe:2.3:o:opensuse:leap:15.1