CVE-2020-35473 Information disclosure in n/a

Medium 4.3 Published 8 Nov 2022 Updated 1 May 2025

Attackers can identify devices using Resolvable Private Addressing via Bluetooth scan response side channels, compromising user privacy.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-35473?

CVE-2020-35473 is a medium-severity vulnerability in n/a, published on 8 Nov 2022. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

An information leakage vulnerability in the Bluetooth Low Energy advertisement scan response in Bluetooth Core Specifications 4.0 through 5.2, and extended scan response in Bluetooth Core Specifications 5.0 through 5.2, may be used to identify devices using Resolvable Private Addressing (RPA) by their response or non-response to specific scan requests from remote addresses. RPAs that have been associated with a specific remote device may also be used to identify a peer in the same manner by using its reaction to an active scan request. This has also been called an allowlist-based side channel.

Weakness: CWE-203, CWE-294

Which versions are affected by CVE-2020-35473?

It affects 1 product.

Products include Bluetooth Bluetooth Core Specification.

How do I fix CVE-2020-35473?

No fix has been published for CVE-2020-35473 yet. Limit exposure of the affected software until one is available.

Is CVE-2020-35473 being exploited?

There is no known exploitation of CVE-2020-35473 in the wild and no public exploit code.

Sources

Also known as GHSA-qw9m-cx2j-p94f.