Vulnerabilities > Bluetooth > Medium

DATE CVE VULNERABILITY TITLE RISK
2023-11-28 CVE-2023-24023 Bluetooth BR/EDR devices with Secure Simple Pairing and Secure Connections pairing in Bluetooth Core Specification 4.2 through 5.4 allow certain man-in-the-middle attacks that force a short key length, and might lead to discovery of the encryption key and live injection, aka BLUFFS.
high complexity
bluetooth microsoft
6.8
2023-06-02 CVE-2022-24695 Unspecified vulnerability in Bluetooth Core Specification
Bluetooth Classic in Bluetooth Core Specification through 5.3 does not properly conceal device information for Bluetooth transceivers in Non-Discoverable mode.
low complexity
bluetooth
4.3
2022-11-08 CVE-2020-35473 Authentication Bypass by Capture-replay vulnerability in Bluetooth Core Specification
An information leakage vulnerability in the Bluetooth Low Energy advertisement scan response in Bluetooth Core Specifications 4.0 through 5.2, and extended scan response in Bluetooth Core Specifications 5.0 through 5.2, may be used to identify devices using Resolvable Private Addressing (RPA) by their response or non-response to specific scan requests from remote addresses.
low complexity
bluetooth CWE-294
4.3
2021-05-24 CVE-2020-26555 Incorrect Authorization vulnerability in multiple products
Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B through 5.2 may permit an unauthenticated nearby device to spoof the BD_ADDR of the peer device to complete pairing without knowledge of the PIN.
5.4
2021-05-24 CVE-2020-26558 Improper Authentication vulnerability in multiple products
Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 through 5.2 may permit a nearby man-in-the-middle attacker to identify the Passkey used during pairing (in the Passkey authentication procedure) by reflection of the public key and the authentication evidence of the initiating device, potentially permitting this attacker to complete authenticated pairing with the responding device using the correct Passkey for the pairing session.
4.2
2021-05-24 CVE-2020-26559 Incorrect Authorization vulnerability in Bluetooth Mesh Profile 1.0.0/1.0.1
Bluetooth Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device (participating in the provisioning protocol) to identify the AuthValue used given the Provisioner’s public key, and the confirmation number and nonce provided by the provisioning device.
low complexity
bluetooth CWE-863
5.8
2021-05-24 CVE-2020-26560 Incorrect Authorization vulnerability in Bluetooth Mesh Profile 1.0.0/1.0.1
Bluetooth Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device, reflecting the authentication evidence from a Provisioner, to complete authentication without possessing the AuthValue, and potentially acquire a NetKey and AppKey.
low complexity
bluetooth CWE-863
4.8
2020-09-11 CVE-2020-15802 Improper Authentication vulnerability in Bluetooth Core Specification
Devices supporting Bluetooth before 5.1 may allow man-in-the-middle attacks, aka BLURtooth.
network
high complexity
bluetooth CWE-287
5.9
2020-05-19 CVE-2020-10135 Authentication Bypass by Spoofing vulnerability in multiple products
Legacy pairing and secure-connections pairing authentication in Bluetooth BR/EDR Core Specification v5.2 and earlier may allow an unauthenticated user to complete authentication without pairing credentials via adjacent access.
low complexity
bluetooth opensuse CWE-290
4.8
2020-05-19 CVE-2020-10134 Interpretation Conflict vulnerability in Bluetooth Core 5.2
Pairing in Bluetooth® Core v5.2 and earlier may permit an unauthenticated attacker to acquire credentials with two pairing devices via adjacent access when the unauthenticated user initiates different pairing methods in each peer device and an end-user erroneously completes both pairing procedures with the MITM using the confirmation number of one peer as the passkey of the other.
4.3