PT-2020-14468 · Nordic Semiconductor · Nordic Semiconductor Android Ble Library

Published 2020-07-07 · Updated 2021-07-21 · CVE-2020-15509

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nordic Semiconductor Android BLE Library versions 2.2.1 and earlier Nordic Semiconductor Android DFU Library versions 1.10.4 and earlier

Description The issue allows the library to engage in unencrypted communication while indicating to the user that the communication is encrypted. This problem occurs during bond creation, specifically in the internalCreateBond function within BleManagerHandler.

Recommendations For Nordic Semiconductor Android BLE Library versions 2.2.1 and earlier, consider disabling the internalCreateBond function in BleManagerHandler until a patch is available. For Nordic Semiconductor Android DFU Library versions 1.10.4 and earlier, restrict the use of bond creation functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2020-15509

Affected Products

Nordic Semiconductor Android Ble Library

References · 6

• https://github.com/NordicSemiconductor/Android-BLE-Library/commits/master · Patch
• https://github.com/NordicSemiconductor/Android-DFU-Library/commits/release · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-15509 · Security Note
• https://secretdiary.ninja/index.php/2020/07/03/norec-attack-stripping-ble-encryption-from-nordicsemis-android-library-cve-2020-15509 · Patch
• https://osv.dev/vulnerability/CVE-2020-15509 · Vendor Advisory
• https://t.me/cvenotify/4911 · Telegram Post