CVE-2020-26555

moderate-risk

Published 2021-05-24

Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B through 5.2 may permit an unauthenticated nearby device to spoof the BD_ADDR of the peer device to complete pairing without knowledge of the PIN.

Do I need to act?

0.22% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.4/10 Medium

ADJACENT_NETWORK / LOW complexity

Affected Products (17)

Bluetooth Core Specification

Fedora

Ax210 Firmware

Ax201 Firmware

Ax200 Firmware

Ac 9560 Firmware

Ac 9462 Firmware

Ac 9461 Firmware

Ac 9260 Firmware

Ac 8265 Firmware

Ac 8260 Firmware

Ac 3168 Firmware

Ac 7265 Firmware

Ac 3165 Firmware

Killer Wi-Fi 6E Ax1675 Firmware

Killer Wi-Fi 6 Ax1650 Firmware

Killer Ac 1550 Firmware

Affected Vendors

Intel Fedoraproject Bluetooth

References (9)

Third Party Advisory https://kb.cert.org/vuls/id/799380

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...

Vendor Advisory https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-securit...

Third Party Advisory https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00520....

Third Party Advisory https://kb.cert.org/vuls/id/799380

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...

Vendor Advisory https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-securit...

Third Party Advisory https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00520....

https://www.kb.cert.org/vuls/id/799380

/ 100

moderate-risk

Severity 18/34 · Moderate

Exploitability 1/34 · Minimal

Exposure 19/34 · Moderate