CVE-2020-26558
CVE-2020-26558 is a medium-severity vulnerability in Bluetooth Bluetooth Core Specification with a CVSS 3.x base score of 4.2. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-287.
Key facts
- Severity: Medium (CVSS 3.x base score 4.2)
- CVSS v2: 4.3
- EPSS exploit prediction: 1% (55th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-287
- Affected product: Bluetooth Bluetooth Core Specification
- Published:
- Last modified:
Description
Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 through 5.2 may permit a nearby man-in-the-middle attacker to identify the Passkey used during pairing (in the Passkey authentication procedure) by reflection of the public key and the authentication evidence of the initiating device, potentially permitting this attacker to complete authenticated pairing with the responding device using the correct Passkey for the pairing session. The attack methodology determines the Passkey value one bit at a time.
Frequently asked questions
- What is CVE-2020-26558?
- Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 through 5.2 may permit a nearby man-in-the-middle attacker to identify the Passkey used during pairing (in the Passkey authentication procedure) by reflection of the public key and the authentication evidence of the initiating device, potentially permitting this attacker to complete authenticated pairing with the responding device using the correct Passkey for the pairing session. The attack methodology determines the Passkey value one bit at a time.
- How severe is CVE-2020-26558?
- CVE-2020-26558 has a CVSS 3.x base score of 4.2, rated medium severity. It is exploitable over an adjacent network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.
- Is CVE-2020-26558 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (55th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2020-26558?
- CVE-2020-26558 primarily affects Bluetooth Bluetooth Core Specification. In total, 19 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2020-26558?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2020-26558 published?
- CVE-2020-26558 was published on 2021-05-24 and last updated on 2026-06-17.
References
- https://kb.cert.org/vuls/id/799380
- https://lists.debian.org/debian-lts-announce/2021/06/msg00019.html
- https://lists.debian.org/debian-lts-announce/2021/06/msg00020.html
- https://lists.debian.org/debian-lts-announce/2021/06/msg00022.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NSS6CTGE4UGTJLCOZOASDR3T3SLL6QJZ/
- https://security.gentoo.org/glsa/202209-16
- https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/reporting-security/
- https://www.debian.org/security/2021/dsa-4951
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00517.html
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00520.html
- https://www.kb.cert.org/vuls/id/799380
Affected products (19)
- cpe:2.3:a:bluetooth:bluetooth_core_specification:*:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
- cpe:2.3:o:intel:ax210_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:intel:ax201_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:intel:ax200_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:intel:ac_9560_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:intel:ac_9462_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:intel:ac_9461_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:intel:ac_9260_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:intel:ac_8265_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:intel:ac_8260_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:intel:ac_3168_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:intel:ac_7265_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:intel:ac_3165_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:intel:ax1675_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:intel:ax1650_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:intel:ac_1550_firmware:-:*:*:*:*:*:*:*
More vulnerabilities in Bluetooth Bluetooth Core Specification
- CVE-2022-25837 — High (CVSS 7.5): Bluetooth® Pairing in Bluetooth Core Specification v1.0B through v5.3 may permit an unauthenticated MITM to acquire…
- CVE-2022-25836 — High (CVSS 7.5): Bluetooth® Low Energy Pairing in Bluetooth Core Specification v4.0 through v5.3 may permit an unauthenticated MITM to…
- CVE-2020-26556 — High (CVSS 7.5): Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device, able to conduct a successful…
- CVE-2023-24023 — Medium (CVSS 6.8): Bluetooth BR/EDR devices with Secure Simple Pairing and Secure Connections pairing in Bluetooth Core Specification 4.2…
- CVE-2020-15802 — Medium (CVSS 5.9): Devices supporting Bluetooth before 5.1 may allow man-in-the-middle attacks, aka BLURtooth. Cross Transport Key…
- CVE-2020-26555 — Medium (CVSS 5.4): Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B through 5.2 may permit an unauthenticated…
All CVEs affecting Bluetooth Bluetooth Core Specification →
Other CWE-287 (Improper Authentication) vulnerabilities
- CVE-2026-45480 — Critical (CVSS 10.0): Improper authentication in Azure Active Directory allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-46389 — Critical (CVSS 10.0): UDS Identity Config builds the Keycloak configuration image (realm, plugins, theme, truststore, JARs) consumed by UDS…
- CVE-2026-10611 — Critical (CVSS 10.0): An authentication bypass vulnerability exists in MISP when LDAP mixed authentication is enabled with OTP enforcement.…
- CVE-2026-47280 — Critical (CVSS 10.0): Improper authentication in Azure Resource Manager (ARM) allows an unauthorized attacker to elevate privileges over a…
- CVE-2026-42822 — Critical (CVSS 10.0): Improper authentication in Azure Local Disconnected Operations allows an unauthorized attacker to elevate privileges…
- CVE-2026-20182 — Critical (CVSS 10.0): May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and…
Browse all CWE-287 (Improper Authentication) vulnerabilities →