PT-2021-11246 · Unknown · Bluetooth Mesh

Published 2021-05-24 · Updated 2022-04-29 · CVE-2020-26556

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Bluetooth Mesh profile versions 1.0 and 1.0.1

Description: The issue allows a nearby device to conduct a successful brute-force attack on an insufficiently random AuthValue before the provisioning procedure times out, potentially completing authentication by leveraging Malleable Commitment. This could be exploited in real-world scenarios where an attacker is in close proximity to the target device.

Recommendations: For Bluetooth Mesh profile version 1.0, consider implementing additional security measures to protect against brute-force attacks on the AuthValue. For Bluetooth Mesh profile version 1.0.1, apply the same mitigation as for version 1.0, focusing on enhancing the randomness of the AuthValue to prevent successful brute-force attacks. As a temporary workaround, consider restricting the provisioning procedure's timeout to minimize the window of opportunity for an attacker to conduct a brute-force attack.

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2020-26556

Affected Products

Bluetooth Mesh

References · 9

• https://bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/reporting-security · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-26556 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-26556 · Security Note
• https://cve.org/CVERecord?id=CVE-2020-26556 · Security Note
• https://ubuntu.com/security/CVE-2020-26556 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-26556 · Vendor Advisory
• https://kb.cert.org/vuls/id/799380 · Note
• https://bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/malleable · Note
• https://t.me/cvenotify/21610 · Telegram Post