CVEvulnerability
CVE-2020-26559
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2021-05-24
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 5.8 MEDIUM — AV:A/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-863
Description
Bluetooth Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device (participating in the provisioning protocol) to identify the AuthValue used given the Provisioner’s public key, and the confirmation number and nonce provided by the provisioning device. This could permit a device without the AuthValue to complete provisioning without brute-forcing the AuthValue.
Affected configurations
• bluetooth mesh profile 1.0.0
• bluetooth mesh profile 1.0.1
Related
Weakness · CWE (1)
- CWE-863 Incorrect Authorization weakness
References
- https://kb.cert.org/vuls/id/799380 Third Party Advisory, US Government Resource
- https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/reporting-security/ Vendor Advisory
- https://kb.cert.org/vuls/id/799380 Third Party Advisory, US Government Resource
- https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/reporting-security/ Vendor Advisory
- https://www.kb.cert.org/vuls/id/799380 www.kb.cert.org