CVE-2020-26558
- State
- Published
- Severity
- Not scored
- Published
- May 24, 2021
- Updated
- Nov 4, 2025
- Reserved
- Oct 4, 2020
Description
Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 through 5.2 may permit a nearby man-in-the-middle attacker to identify the Passkey used during pairing (in the Passkey authentication procedure) by reflection of the public key and the authentication evidence of the initiating device, potentially permitting this attacker to complete authenticated pairing with the responding device using the correct Passkey for the pairing session. The attack methodology determines the Passkey value one bit at a time.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/reporting-security/
- https://kb.cert.org/vuls/id/799380
- FEDORA-2021-a35b44fd9fvendor-advisory
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00520.html
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00517.html
- [debian-lts-announce] 20210623 [SECURITY] [DLA 2689-1] linux security updatemailing-list
- [debian-lts-announce] 20210623 [SECURITY] [DLA 2690-1] linux-4.19 security updatemailing-list
- [debian-lts-announce] 20210626 [SECURITY] [DLA 2692-1] bluez security updatemailing-list
- DSA-4951vendor-advisory
- GLSA-202209-16vendor-advisory
- https://www.kb.cert.org/vuls/id/799380
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.