CVE-2020-35473

low-risk

Published 2022-11-08

An information leakage vulnerability in the Bluetooth Low Energy advertisement scan response in Bluetooth Core Specifications 4.0 through 5.2, and extended scan response in Bluetooth Core Specifications 5.0 through 5.2, may be used to identify devices using Resolvable Private Addressing (RPA) by their response or non-response to specific scan requests from remote addresses. RPAs that have been associated with a specific remote device may also be used to identify a peer in the same manner by using its reaction to an active scan request. This has also been called an allowlist-based side channel.

Do I need to act?

0.14% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 4.3/10 Medium

ADJACENT_NETWORK / LOW complexity

Affected Products (1)

Bluetooth Core Specification

Affected Vendors

Bluetooth

References (4)

Technical Description https://dl.acm.org/doi/10.1145/3548606.3559372

Technical Description https://www.sigsac.org/ccs/CCS2022/proceedings/ccs-proceedings.html

Technical Description https://dl.acm.org/doi/10.1145/3548606.3559372

Technical Description https://www.sigsac.org/ccs/CCS2022/proceedings/ccs-proceedings.html

/ 100

low-risk

Severity 15/34 · Moderate

Exploitability 1/34 · Minimal

Exposure 5/34 · Minimal