PT-2021-11247 · Unknown · Bluetooth Mesh

Published 2021-05-24 · Updated 2025-08-30 · CVE-2020-26557

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Bluetooth Mesh profile versions 1.0 and 1.0.1

Description: The issue allows a nearby device to potentially determine the AuthValue used in the provisioning protocol via a brute-force attack, unless the AuthValue is sufficiently random and changed each time.

Recommendations: For Bluetooth Mesh profile version 1.0, ensure the AuthValue is sufficiently random and changed each time to mitigate the risk. For Bluetooth Mesh profile version 1.0.1, ensure the AuthValue is sufficiently random and changed each time to mitigate the risk.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2020-26557

Affected Products

Bluetooth Mesh

References · 10

• https://bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/reporting-security · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-26557 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-26557 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-26557 · Security Note
• https://cve.org/CVERecord?id=CVE-2020-26557 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-26557 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1960009 · Note
• https://twitter.com/XTeamPal/status/1961646040966410620 · Twitter Post
• https://kb.cert.org/vuls/id/799380 · Note
• https://bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/predicatable-authvalue · Note