CVE-2020-13593: High severity ti simplelink cc2640r2 software development kit vulnerability
The Bluetooth Low Energy Secure Manager Protocol (SMP) implementation in Texas Instruments SimpleLink SIMPLELINK-CC2640R2-SDK through 2.2.3 allows the Diffie-Hellman check during the Secure Connection pairing to be skipped if the Link Layer encryption setup is performed earlier. An attacker in radio range can achieve arbitrary read/write access to protected GATT service data, cause a denial of service, or possibly control a device's function by establishing an encrypted session with an unauthenticated Long Term Key (LTK).
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-13593?
CVE-2020-13593 is a vulnerability in the Bluetooth Low Energy Secure Manager Protocol (SMP) implementation in Texas Instruments SimpleLink SIMPLELINK-CC2640R2-SDK through 2.2.3.
What is the severity of CVE-2020-13593?
CVE-2020-13593 has a severity rating of 8.8 (high).
Which software is affected by CVE-2020-13593?
The Ti Simplelink-cc2640r2 Software Development Kit (SDK) version up to 2.2.3 is affected by CVE-2020-13593.
How can an attacker exploit CVE-2020-13593?
An attacker in radio range can exploit CVE-2020-13593 by skipping the Diffie-Hellman check during the Secure Connection pairing if the Link Layer encryption setup is performed earlier.
How can I fix CVE-2020-13593?
To fix CVE-2020-13593, Texas Instruments recommends updating to the latest version of the Ti Simplelink-cc2640r2 Software Development Kit (SDK).