CVE-2020-26559 is a high-severity vulnerability affecting Bluetooth Mesh Provisioning in versions 1.0 and 1.0.1 of the Bluetooth Mesh profile. A nearby attacker participating in the provisioning protocol can deduce the AuthValue, bypassing brute-force protection and potentially completing provisioning without authorization. With a CVSS score of 8.8, this vulnerability is easily exploitable over an adjacent network with no user interaction, leading to high impacts on confidentiality, integrity, and availability. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion, though it has received some media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
1.0.0CPE matchmatch criteria | cpe:2.3:a:bluetooth:mesh_profile:1.0.0:*:*:*:*:*:*:* | ||
1.0.1CPE matchmatch criteria | cpe:2.3:a:bluetooth:mesh_profile:1.0.1:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.2 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.