CVE-2020-10135

Katalog CVE

CVSS 5.4 · Medium EPSS 2,4%

Kerentanan Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade') pada bluetooth core, opensuse leap. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

Legacy pairing and secure-connections pairing authentication in Bluetooth BR/EDR Core Specification v5.2 and earlier may allow an unauthenticated user to complete authentication without pairing credentials via adjacent access. An unauthenticated, adjacent attacker could impersonate a Bluetooth BR/EDR master or slave to pair with a previously paired remote device to successfully complete the authentication procedure without knowing the link key.

Rincian

Terbit di NVD

19 Mei 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.4 (Medium), sumber NVD
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-757: Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')
CWE-290: Authentication Bypass by Spoofing

EPSS (30 hari)

2,4% peluang dieksploitasi; lebih tinggi dari 83,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.bluetooth.com/learn-about-bluetooth/bluetooth-technology/bluetooth-security/bias-vulnerability/ advisory vendor
• https://kb.cert.org/vuls/id/647177/ advisory pihak ketiga · pemerintah AS
• http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00009.html broken link · mailing list · advisory pihak ketiga
• http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00047.html broken link · mailing list · advisory pihak ketiga
• http://packetstormsecurity.com/files/157922/Bluetooth-Impersonation-Attack-BIAS-Proof-Of-Concept.html advisory pihak ketiga · vdb entry
• http://seclists.org/fulldisclosure/2020/Jun/5 exploit · mailing list · advisory pihak ketiga
• https://francozappa.github.io/about-bias/ advisory pihak ketiga