HOMEVULNERABILITIESCVE-2020-10135
MEDIUM

CVE-2020-10135

CWE-757Published: May 19, 2020· Updated: Jun 17, 2026

5.4
CVSS v3.1

Official Description

Legacy pairing and secure-connections pairing authentication in Bluetooth BR/EDR Core Specification v5.2 and earlier may allow an unauthenticated user to complete authentication without pairing credentials via adjacent access. An unauthenticated, adjacent attacker could impersonate a Bluetooth BR/EDR master or slave to pair with a previously paired remote device to successfully complete the authentication procedure without knowing the link key.

NVD Source

Technical Analysis

CVE-2020-10135 requires adjacent network access, limiting remote exploitation but still posing risk in shared or local network environments.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

CVSS v3.1 Vector Breakdown

Exploitability
Attack VectorAdjacent
Attack ComplexityLow
Privileges Req.None
User InteractionNone
ScopeUnchanged
Impact
ConfidentialityLow
IntegrityLow
AvailabilityNone
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Affected Vendors & Products

bluetooth1 product(s)
bluetooth core
openSUSE1 product(s)
leap
Source: NVD CPE · 2 total CPE entries

Exploit & PoC Resources

NO KNOWN EXPLOITNo public exploit confirmed at this time
Exploit-DB
Offensive Security exploit database
GitHub PoC Search
Community PoC repositories
Rapid7 / Metasploit
Metasploit module search
PacketStorm
Security advisories & exploits
NVD Detail
Official NIST entry
MITRE CVE
CVE Program entry
External links open in a new tab. Always verify in a controlled environment before use.

Official Patches & Advisories

ADVISORYhttp://lists.opensuse.org/opensuse-security-announce/2020-08/msg00009.html
ADVISORYhttp://lists.opensuse.org/opensuse-security-announce/2020-08/msg00047.html
ADVISORYhttp://packetstormsecurity.com/files/157922/Bluetooth-Impersonation-Attack-BIAS-Proof-Of-Concept.html
ADVISORYhttp://seclists.org/fulldisclosure/2020/Jun/5
ADVISORYhttps://francozappa.github.io/about-bias/
ADVISORYhttps://kb.cert.org/vuls/id/647177/
ADVISORYhttps://www.bluetooth.com/learn-about-bluetooth/bluetooth-technology/bluetooth-security/bias-vulnerability/
ADVISORYhttp://lists.opensuse.org/opensuse-security-announce/2020-08/msg00009.html
ADVISORYhttp://lists.opensuse.org/opensuse-security-announce/2020-08/msg00047.html
ADVISORYhttp://packetstormsecurity.com/files/157922/Bluetooth-Impersonation-Attack-BIAS-Proof-Of-Concept.html
ADVISORYhttp://seclists.org/fulldisclosure/2020/Jun/5
ADVISORYhttps://francozappa.github.io/about-bias/
ADVISORYhttps://kb.cert.org/vuls/id/647177/
ADVISORYhttps://www.bluetooth.com/learn-about-bluetooth/bluetooth-technology/bluetooth-security/bias-vulnerability/

All References (14)

→
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00009.htmlBroken Link · Mailing List · Third Party Advisory
→
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00047.htmlBroken Link · Mailing List · Third Party Advisory
→
http://packetstormsecurity.com/files/157922/Bluetooth-Impersonation-Attack-BIAS-Proof-Of-Concept.htmlThird Party Advisory · VDB Entry
→
http://seclists.org/fulldisclosure/2020/Jun/5Exploit · Mailing List · Third Party Advisory
→
https://francozappa.github.io/about-bias/Third Party Advisory
→
https://kb.cert.org/vuls/id/647177/Third Party Advisory · US Government Resource
→
https://www.bluetooth.com/learn-about-bluetooth/bluetooth-technology/bluetooth-security/bias-vulnerability/Vendor Advisory
→
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00009.htmlBroken Link · Mailing List · Third Party Advisory
→
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00047.htmlBroken Link · Mailing List · Third Party Advisory
→
http://packetstormsecurity.com/files/157922/Bluetooth-Impersonation-Attack-BIAS-Proof-Of-Concept.htmlThird Party Advisory · VDB Entry
→
http://seclists.org/fulldisclosure/2020/Jun/5Exploit · Mailing List · Third Party Advisory
→
https://francozappa.github.io/about-bias/Third Party Advisory
→
https://kb.cert.org/vuls/id/647177/Third Party Advisory · US Government Resource
→
https://www.bluetooth.com/learn-about-bluetooth/bluetooth-technology/bluetooth-security/bias-vulnerability/Vendor Advisory

Quick Facts

CVE IDCVE-2020-10135
CVSS Score5.4 / 10
SeverityMEDIUM
WeaknessCWE-757
CISA KEVNo
Affected2 vendor(s)
PublishedMay 19, 2020

Related CVEs (CWE-757)

CVE-2024-4995
9.8
CVE-2019-14887
9.1
CVE-2024-38883
9.1
CVE-2024-8773
8.3
CVE-2023-2974
8.1
CVE-2018-25029
8.1

Recommended Actions

  • →Apply vendor patches immediately
  • →Monitor CVE-2020-10135 in threat intel feeds
  • →Review IDS/IPS signatures for exploitation attempts
Data sourced from NVD (NIST), CISA KEV, and EPSS (FIRST). Analysis generated by CTIWATCH.COM. CVE data is provided under the NVD usage policy.
← All Vulnerabilities·Search for CVE-2020-10135·NVD