CVEvulnerability
CVE-2020-26558
4.2 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2021-05-24
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 4.2 MEDIUM — CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:A/AC:M/Au:N/C:P/I:P/A:N
- Weaknesses
- CWE-287
Description
Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 through 5.2 may permit a nearby man-in-the-middle attacker to identify the Passkey used during pairing (in the Passkey authentication procedure) by reflection of the public key and the authentication evidence of the initiating device, potentially permitting this attacker to complete authenticated pairing with the responding device using the correct Passkey for the pairing session. The attack methodology determines the Passkey value one bit at a time.
Affected configurations
• bluetooth bluetooth core specification (>= 2.1 <= 5.2)
• fedoraproject fedora 34
• debian debian linux 9.0
• linux linux kernel (< 5.13)
• intel ax210 firmware
• intel ax201 firmware
• intel ax200 firmware
• intel ac 9560 firmware
• intel ac 9462 firmware
• intel ac 9461 firmware
• intel ac 9260 firmware
• intel ac 8265 firmware
• intel ac 8260 firmware
• intel ac 3168 firmware
• intel ac 7265 firmware
• intel ac 3165 firmware
• intel ax1675 firmware
• intel ax1650 firmware
• intel ac 1550 firmware
Related
Weakness · CWE (1)
- CWE-287 Improper Authentication weakness
References
- https://kb.cert.org/vuls/id/799380 Third Party Advisory, US Government Resource
- https://lists.debian.org/debian-lts-announce/2021/06/msg00019.html Mailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/06/msg00020.html Mailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/06/msg00022.html Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NSS6CTGE4UGTJLCOZOASDR3T3SLL6QJZ/ lists.fedoraproject.org
- https://security.gentoo.org/glsa/202209-16 Third Party Advisory
- https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/reporting-security/ Vendor Advisory
- https://www.debian.org/security/2021/dsa-4951 Third Party Advisory
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00517.html Third Party Advisory
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00520.html Third Party Advisory
- https://kb.cert.org/vuls/id/799380 Third Party Advisory, US Government Resource
- https://lists.debian.org/debian-lts-announce/2021/06/msg00019.html Mailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/06/msg00020.html Mailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/06/msg00022.html Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NSS6CTGE4UGTJLCOZOASDR3T3SLL6QJZ/ lists.fedoraproject.org
- https://security.gentoo.org/glsa/202209-16 Third Party Advisory
- https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/reporting-security/ Vendor Advisory
- https://www.debian.org/security/2021/dsa-4951 Third Party Advisory
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00517.html Third Party Advisory
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00520.html Third Party Advisory
- https://www.kb.cert.org/vuls/id/799380 www.kb.cert.org