CVEvulnerability
CVE-2020-15509
6.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2020-07-07
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 6.5 MEDIUM — CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS 2.0 ([email protected])
- 3.3 LOW — AV:A/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-319
Description
Nordic Semiconductor Android BLE Library through 2.2.1 and DFU Library through 1.10.4 for Android (as used by nRF Connect and other applications) can engage in unencrypted communication while showing the user that the communication is purportedly encrypted. The problem is in bond creation (e.g., internalCreateBond in BleManagerHandler).
Affected configurations
• nordicsemi android ble library (<= 2.2.1)
• nordicsemi dfu library (<= 1.10.4)
Related
Weakness · CWE (1)
- CWE-319 Cleartext Transmission of Sensitive Information weakness
References
- https://github.com/NordicSemiconductor/Android-BLE-Library/commits/master Patch, Third Party Advisory
- https://github.com/NordicSemiconductor/Android-DFU-Library/commits/release Patch, Third Party Advisory
- https://secretdiary.ninja/index.php/2020/07/03/norec-attack-stripping-ble-encryption-from-nordicsemis-android-library-cve-2020-15509/ Patch, Third Party Advisory
- https://github.com/NordicSemiconductor/Android-BLE-Library/commits/master Patch, Third Party Advisory
- https://github.com/NordicSemiconductor/Android-DFU-Library/commits/release Patch, Third Party Advisory
- https://secretdiary.ninja/index.php/2020/07/03/norec-attack-stripping-ble-encryption-from-nordicsemis-android-library-cve-2020-15509/ Patch, Third Party Advisory