CVE Vulnerability

CVE-2020-15802

Devices supporting Bluetooth before 5.1 may allow man-in-the-middle attacks, aka BLURtooth. Cross Transport Key Derivation in Bluetooth Core Specification v4.2 and v5.0 may permit an unauthenticated user to establish a bonding with one transport, either LE or BR/EDR, and replace a bonding already established on the opposing transport, BR/EDR or LE, potentially overwriting an authenticated key with an unauthenticated key, or a key with greater entropy with one with less.

4.3 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 8.6 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

Scope

5.9 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://gizmodo.com/bluetooth-unveils-its-latest-security-issue-with-no-se-1845013709 Third Party Advisory
https://www.kb.cert.org/vuls/id/589825 Third Party Advisory US Government Resource
https://www.bluetooth.com/learn-about-bluetooth/bluetooth-technology/bluetooth-security/blurtooth/ Vendor Advisory
Configurations

Configuration 1

cpe:2.3:a:bluetooth:bluetooth_core_specification:*:*:*:*:*:*:*:*
Information

Published : 2020-09-11 02:15

Updated : 2022-11-16 03:19

NVD link : CVE-2020-15802

Mitre link : CVE-2020-15802

Products Affected
No products.
CWE
CWE-287