CVE-2020-26556
Severity Score
7.5
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device, able to conduct a successful brute-force attack on an insufficiently random AuthValue before the provisioning procedure times out, to complete authentication by leveraging Malleable Commitment.
Un Mesh Provisioning en el perfil de Bluetooth Mesh versiones 1.0 y 1.0.1, puede permitir a un dispositivo cercano, capaz de conducir un ataque de fuerza bruta con éxito en un AuthValue insuficientemente aleatorio antes de que se agote el tiempo de espera del procedimiento de aprovisionamiento, para completar la autenticación al aprovechar Malleable Commitment
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2020-10-04 CVE Reserved
- 2021-05-24 CVE Published
- 2023-12-29 EPSS Updated
- 2024-08-04 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-307: Improper Restriction of Excessive Authentication Attempts
CAPEC
References (3)
| URL | Tag | Source |
|---|---|---|
| https://kb.cert.org/vuls/id/799380 | Third Party Advisory |
|
| https://www.kb.cert.org/vuls/id/799380 | Third Party Advisory |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Bluetooth Search vendor "Bluetooth" | Bluetooth Core Specification Search vendor "Bluetooth" for product "Bluetooth Core Specification" | >= 1.0b <= 5.2 Search vendor "Bluetooth" for product "Bluetooth Core Specification" and version " >= 1.0b <= 5.2" | - |
Affected
| ||||||
| Bluetooth Search vendor "Bluetooth" | Mesh Profile Search vendor "Bluetooth" for product "Mesh Profile" | 1.0.0 Search vendor "Bluetooth" for product "Mesh Profile" and version "1.0.0" | - |
Affected
| ||||||
| Bluetooth Search vendor "Bluetooth" | Mesh Profile Search vendor "Bluetooth" for product "Mesh Profile" | 1.0.1 Search vendor "Bluetooth" for product "Mesh Profile" and version "1.0.1" | - |
Affected
| ||||||