CVE-2020-10135 Bluetooth devices supporting BR/EDR v5.2 and earlier are vulnerable to impersonation attacks
Adjacent attackers can bypass Bluetooth authentication to impersonate devices and pair without credentials, affecting OS-level Bluetooth stacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-10135?
CVE-2020-10135 is a medium-severity authentication bypass vulnerability in Opensuse Leap, published on 19 May 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Legacy pairing and secure-connections pairing authentication in Bluetooth BR/EDR Core Specification v5.2 and earlier may allow an unauthenticated user to complete authentication without pairing credentials via adjacent access. An unauthenticated, adjacent attacker could impersonate a Bluetooth BR/EDR master or slave to pair with a previously paired remote device to successfully complete the authentication procedure without knowing the link key.
Which versions are affected by CVE-2020-10135?
It affects 2 products.
Products include Bluetooth Bluetooth Core, Opensuse Leap.
How do I fix CVE-2020-10135?
Apply the vendor's patch.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2020-10135 being exploited?
There is no known exploitation of CVE-2020-10135 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Opensuse Leap
Sources
Also known as GHSA-mg6c-h9c4-rcc2, UBUNTU-CVE-2020-10135.