Vulnerabilities > CVE-2020-26556 - Improper Restriction of Excessive Authentication Attempts vulnerability in Bluetooth Core Specification and Mesh Profile

CVSS 2.9 - LOW

Attack vector

ADJACENT_NETWORK

Attack complexity

MEDIUM

Privileges required

NONE

Confidentiality impact

PARTIAL

Integrity impact

NONE

Availability impact

NONE

bluetooth

CWE-307

NVD

Published: 2021-05-24

Updated: 2022-04-29

Summary

Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device, able to conduct a successful brute-force attack on an insufficiently random AuthValue before the provisioning procedure times out, to complete authentication by leveraging Malleable Commitment.

Vulnerable Configurations

Part	Description	Count
Application	Bluetooth Bluetooth Mesh Profile 1.0.0 Bluetooth Mesh Profile 1.0.1 Bluetooth Bluetooth Core Specification 1.1B Bluetooth Bluetooth Core Specification 1.2 Bluetooth Bluetooth Core Specification 2.0 Bluetooth Bluetooth Core Specification 2.1 Bluetooth Bluetooth Core Specification 3.0 Bluetooth Bluetooth Core Specification 4.0 Bluetooth Bluetooth Core Specification 4.1 Bluetooth Bluetooth Core Specification 4.2 Bluetooth Bluetooth Core Specification 5.0 Bluetooth Bluetooth Core Specification 5.1 Bluetooth Bluetooth Core Specification 5.2	13

Common Weakness Enumeration (CWE)

CWE-307 - Improper Restriction of Excessive Authentication Attempts

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References