CVE-2020-35473

Katalog CVE

CVSS 4.3 · Medium EPSS 0,35%

Kerentanan Observable Discrepancy pada bluetooth core specification. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

An information leakage vulnerability in the Bluetooth Low Energy advertisement scan response in Bluetooth Core Specifications 4.0 through 5.2, and extended scan response in Bluetooth Core Specifications 5.0 through 5.2, may be used to identify devices using Resolvable Private Addressing (RPA) by their response or non-response to specific scan requests from remote addresses. RPAs that have been associated with a specific remote device may also be used to identify a peer in the same manner by using its reaction to an active scan request. This has also been called an allowlist-based side channel.

Rincian

Terbit di NVD

8 November 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-203: Observable Discrepancy
CWE-294: Authentication Bypass by Capture-replay

EPSS (30 hari)

0,35% peluang dieksploitasi; lebih tinggi dari 27,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://dl.acm.org/doi/10.1145/3548606.3559372 deskripsi teknis · advisory pihak ketiga
• https://www.sigsac.org/ccs/CCS2022/proceedings/ccs-proceedings.html deskripsi teknis · advisory pihak ketiga