CVE-2020-10135: Bluetooth devices supporting BR/EDR v5.2 and earlier are vulnerable to impersonation attacks
Vulnerability summary
CVE-2020-10135 is a medium (CVSS 5.4) vulnerability in bluetooth bluetooth_core. EPSS estimates a 2.37% chance of exploitation in the next 30 days, higher than 83.8% of scored vulnerabilities. 1 public exploit is recorded.
Not severe (CVSS 5.4, adjacent network); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 25 · Related 24Timeline
- 19-05-2020PublishedVulnerability first disclosed.
- 17-09-2024Last modifiedVulnerability information updated.
Description
Legacy pairing and secure-connections pairing authentication in Bluetooth BR/EDR Core Specification v5.2 and earlier may allow an unauthenticated user to complete authentication without pairing credentials via adjacent access. An unauthenticated, adjacent attacker could impersonate a Bluetooth BR/EDR master or slave to pair with a previously paired remote device to successfully complete the authentication procedure without knowing the link key.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated5.4MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- NVDNIST5.4MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
EPSS trend
Probability
2.37%
Chance of exploitation in the next 30 days
Percentile
84%
Versus all other CVEs
30-day change
No change 0.00 pp
From 2.37% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (seclists.org)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-757Selection of Less-Secure Algorithm During NegotiationA protocol or its implementation supports interaction between multiple actors and allows those actors to negotiate which algorithm should be used in a protection mechanism such as encryption or authentication, but it does not select the strongest algorithm that is available to both parties.
- CWE-290Authentication Bypass by SpoofingThis attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
Affected systems
Known conditions: adjacent network, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu45 products
- linuxAll versions (No fix recorded) | < 4.4.0-197.229 | < 4.15.0-129.132 | < 5.4.0-56.62
- linux-aws< 4.4.0-1082.86 | < 4.4.0-1118.132 | < 4.15.0-1091.96 | < 5.4.0-1030.31
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.3All versions (No fix recorded)
- linux-aws-5.4< 5.4.0-1030.31~18.04.1
Bluetooth2 products
- bluetooth_core≤ 5.2
- br/edr5.2
Opensuse1 product
- leapEOL15.1
3 vendors · 48 products
References
19 links- lists.opensuse.org/opensuse-security-announce/2020-08/msg00009.htmlVendor AdvisoryX Refsource SUSEBroken LinkMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2020-08/msg00047.htmlVendor AdvisoryX Refsource SUSEBroken LinkMailing ListThird Party Advisory
- www.bluetooth.com/learn-about-bluetooth/bluetooth-technology/bluetooth-security/bias-vulnerability/X Refsource CONFIRMREPORTVendor Advisory
- packetstormsecurity.com/files/157922/Bluetooth-Impersonation-Attack-BIAS-Proof-Of-Concept.htmlX Refsource MISCThird Party AdvisoryVDB Entry