CVE-2020-35693
First published: Thu Dec 24 2020(Updated: )
On some Samsung phones and tablets running Android through 7.1.1, it is possible for an attacker-controlled Bluetooth Low Energy (BLE) device to pair silently with a vulnerable target device, without any user interaction, when the target device's Bluetooth is on, and it is running an app that offers a connectable BLE advertisement. An example of such an app could be a Bluetooth-based contact tracing app, such as Australia's COVIDSafe app, Singapore's TraceTogether app, or France's TousAntiCovid (formerly StopCovid). As part of the pairing process, two pieces (among others) of personally identifiable information are exchanged: the Identity Address of the Bluetooth adapter of the target device, and its associated Identity Resolving Key (IRK). Either one of these identifiers can be used to perform re-identification of the target device for long term tracking. The list of affected devices includes (but is not limited to): Galaxy Note 5, Galaxy S6 Edge, Galaxy A3, Tab A (2017), J2 Pro (2018), Galaxy Note 4, and Galaxy S5.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Google Android | <=7.1.1 | |
| Samsung Galaxy A3 | ||
| Samsung Galaxy Note 4 | ||
| Samsung Galaxy Note 5 | ||
| Samsung Galaxy S5 | ||
| Samsung Galaxy S6 Edge | ||
| Samsung J2 Pro \(2018\) | ||
| Samsung Tab A \(2017\) |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is CVE-2020-35693?
CVE-2020-35693 is a vulnerability found on some Samsung phones and tablets running Android through 7.1.1 that allows an attacker-controlled Bluetooth Low Energy (BLE) device to pair silently with a vulnerable target device.
Which devices are affected by CVE-2020-35693?
Devices running Android through 7.1.1 and Samsung Galaxy A3, Samsung Galaxy Note 4, Samsung Galaxy Note 5, Samsung Galaxy S5, Samsung Galaxy S6 Edge, Samsung J2 Pro (2018), Samsung Tab A (2017) are affected by CVE-2020-35693.
What is the severity of CVE-2020-35693?
CVE-2020-35693 has a severity rating of 8.8 (high).
How does CVE-2020-35693 exploit the vulnerability?
CVE-2020-35693 exploits the vulnerability by silently pairing an attacker-controlled Bluetooth Low Energy (BLE) device with a vulnerable target device when the target device's Bluetooth is on and it is running an app that offers BLE functionality.
How do I mitigate the CVE-2020-35693 vulnerability?
To mitigate the CVE-2020-35693 vulnerability, update your device to a version of Android higher than 7.1.1 and make sure your device's Bluetooth is turned off when not in use.
- agent/references
- agent/severity
- agent/author
- agent/type
- agent/event
- agent/description
- agent/softwarecombine
- agent/first-publish-date
- agent/last-modified-date
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/mitre-cve
- source/MITRE
- vendor/google
- canonical/google android
- version/google android/7.1.1
- vendor/samsung
- canonical/samsung galaxy a3
- canonical/samsung galaxy note 4
- canonical/samsung galaxy note 5
- canonical/samsung galaxy s5
- canonical/samsung galaxy s6 edge
- canonical/samsung j2 pro \(2018\)
- canonical/samsung tab a \(2017\)