CVE-2020-15509: Medium severity nordicsemi android ble library vulnerability
Nordic Semiconductor Android BLE Library through 2.2.1 and DFU Library through 1.10.4 for Android (as used by nRF Connect and other applications) can engage in unencrypted communication while showing the user that the communication is purportedly encrypted. The problem is in bond creation (e.g., internalCreateBond in BleManagerHandler).
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2020-15509?
CVE-2020-15509 is a vulnerability in Nordic Semiconductor Android BLE Library through version 2.2.1 and DFU Library through version 1.10.4 for Android, which allows unencrypted communication to be displayed as encrypted.
What is the severity of CVE-2020-15509?
The severity of CVE-2020-15509 is medium, with a severity value of 6.5.
How does CVE-2020-15509 affect Nordic Semiconductor Android BLE Library?
CVE-2020-15509 affects Nordic Semiconductor Android BLE Library through version 2.2.1 by allowing unencrypted communication to be shown as encrypted.
How does CVE-2020-15509 affect Nordic Semiconductor DFU Library?
CVE-2020-15509 affects Nordic Semiconductor DFU Library through version 1.10.4 by allowing unencrypted communication to be shown as encrypted.
Is there a fix for CVE-2020-15509?
Yes, the fix for CVE-2020-15509 is to update Nordic Semiconductor Android BLE Library to a version beyond 2.2.1 and DFU Library to a version beyond 1.10.4.