Vulnerability Description
An information leakage vulnerability in the Bluetooth Low Energy advertisement scan response in Bluetooth Core Specifications 4.0 through 5.2, and extended scan response in Bluetooth Core Specifications 5.0 through 5.2, may be used to identify devices using Resolvable Private Addressing (RPA) by their response or non-response to specific scan requests from remote addresses. RPAs that have been associated with a specific remote device may also be used to identify a peer in the same manner by using its reaction to an active scan request. This has also been called an allowlist-based side channel.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bluetooth | Bluetooth Core Specification | >= 4.0, <= 5.2 |
Related Weaknesses (CWE)
References
- https://dl.acm.org/doi/10.1145/3548606.3559372Technical DescriptionThird Party Advisory
- https://www.sigsac.org/ccs/CCS2022/proceedings/ccs-proceedings.htmlTechnical DescriptionThird Party Advisory
- https://dl.acm.org/doi/10.1145/3548606.3559372Technical DescriptionThird Party Advisory
- https://www.sigsac.org/ccs/CCS2022/proceedings/ccs-proceedings.htmlTechnical DescriptionThird Party Advisory
FAQ
What is CVE-2020-35473?
CVE-2020-35473 is a vulnerability with a CVSS score of 4.3 (MEDIUM). An information leakage vulnerability in the Bluetooth Low Energy advertisement scan response in Bluetooth Core Specifications 4.0 through 5.2, and extended scan response in Bluetooth Core Specificatio...
How severe is CVE-2020-35473?
CVE-2020-35473 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-35473?
Check the references section above for vendor advisories and patch information. Affected products include: Bluetooth Bluetooth Core Specification.