CVE-2020-15802: Medium severity bluetooth core specification vulnerability
Devices supporting Bluetooth before 5.1 may allow man-in-the-middle attacks, aka BLURtooth. Cross Transport Key Derivation in Bluetooth Core Specification v4.2 and v5.0 may permit an unauthenticated user to establish a bonding with one transport, either LE or BR/EDR, and replace a bonding already established on the opposing transport, BR/EDR or LE, potentially overwriting an authenticated key with an unauthenticated key, or a key with greater entropy with one with less.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-15802?
CVE-2020-15802 is a vulnerability that allows man-in-the-middle attacks on devices supporting Bluetooth before version 5.1, also known as BLURtooth.
What is the severity of CVE-2020-15802?
The severity of CVE-2020-15802 is high, with a severity value of 5.9.
Which devices are affected by CVE-2020-15802?
Devices supporting Bluetooth before version 5.1, such as Google Android, are affected by CVE-2020-15802.
How does CVE-2020-15802 work?
CVE-2020-15802 allows an unauthenticated user to establish a bonding with one transport (either LE or BR/EDR) and replace an existing bonding.
Is there a fix for CVE-2020-15802?
Yes, patching the affected devices to a version of Bluetooth 5.1 or newer will mitigate the vulnerability.