Log in Start free

Vulnerability · Published May 24, 2021 · Assigned by mitre

CVE-2020-26558

Medium 4.2

In plain English

A medium-severity security flaw in the bluez package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)4.2Medium
Exploit odds (30 days)0.9%top 40.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 through 5.2 may permit a nearby man-in-the-middle attacker to identify the Passkey used during pairing (in the Passkey authentication procedure) by reflection of the public key and the authentication evidence of the initiating device, potentially permitting this attacker to complete authenticated pairing with the responding device using the correct Passkey for the pairing session. The attack methodology determines the Passkey value one bit at a time.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12bluez5.55-3.1DEBIAN-CVE-2020-26558
Debian:13bluez5.55-3.1DEBIAN-CVE-2020-26558
Debian:14bluez5.55-3.1DEBIAN-CVE-2020-26558
Debian:12linux5.10.40-1DEBIAN-CVE-2020-26558
Debian:13linux5.10.40-1DEBIAN-CVE-2020-26558
Debian:14linux5.10.40-1DEBIAN-CVE-2020-26558
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2020-26558
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2020-26558
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2020-26558

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

References