Is CVE-2020-16630 actively exploited?

No active exploitation of CVE-2020-16630 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2020-16630 be exploited remotely?

Partially. CVE-2020-16630 requires adjacent network access (same network segment) to exploit.

What is the CVSS score of CVE-2020-16630?

CVE-2020-16630 has a CVSS score of 6.8 (MEDIUM).

HOME VULNERABILITIESCVE-2020-16630

MEDIUM

CVE-2020-16630

CWE-863Published: September 20, 2021· Updated: Jun 17, 2026

6.8

CVSS v3.1

Official Description

TI’s BLE stack caches and reuses the LTK’s property for a bonded mobile. A LTK can be an unauthenticated-and-no-MITM-protection key created by Just Works or an authenticated-and-MITM-protection key created by Passkey Entry, Numeric Comparison or OOB. Assume that a victim mobile uses secure pairing to pair with a victim BLE device based on TI chips and generate an authenticated-and-MITM-protection LTK. If a fake mobile with the victim mobile’s MAC address uses Just Works and pairs with the victim device, the generated LTK still has the property of authenticated-and-MITM-protection. Therefore, the fake mobile can access attributes with the authenticated read/write permission.

NVD Source

Technical Analysis

CVE-2020-16630 requires adjacent network access, limiting remote exploitation but still posing risk in shared or local network environments.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), with a CVSS base score of 6.8.