PT-2021-11248 · Unknown · Bluetooth Mesh

Published 2021-05-24 · Updated 2025-08-30 · CVE-2020-26559

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Bluetooth Mesh profile versions 1.0 through 1.0.1

Description: The issue allows a nearby device participating in the provisioning protocol to identify the AuthValue used, given the Provisioner's public key, and the confirmation number and nonce provided by the provisioning device. This could permit a device without the AuthValue to complete provisioning without brute-forcing the AuthValue.

Recommendations: For Bluetooth Mesh profile versions 1.0 through 1.0.1, consider restricting access to the provisioning protocol to minimize the risk of exploitation. As a temporary workaround, limit the ability of nearby devices to participate in the provisioning protocol until a fix is available. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2020-26559

Affected Products

Bluetooth Mesh

References · 10

• https://bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/reporting-security · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-26559 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-26559 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-26559 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-26559 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-26559 · Security Note
• https://bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/authvalue-leak · Note
• https://twitter.com/XTeamPal/status/1961646040966410620 · Twitter Post
• https://bugzilla.redhat.com/show_bug.cgi?id=1960011 · Note
• https://kb.cert.org/vuls/id/799380 · Note