CVE-2020-14292

In the COVIDSafe application through 1.0.21 for Android, unsafe use of the Bluetooth transport option in the GATT connection allows attackers to trick the application into establishing a connection over Bluetooth BR/EDR transport, which reveals the public Bluetooth address of the victim's phone without authorisation, bypassing the Bluetooth address randomisation protection in the user's phone.

CVSS v3.1

5.7 MEDIUMCVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

CVSS v2.0

2.9 LOWAV:A/AC:M/Au:N/C:P/I:N/A:N

EPSS

1.31% chance of exploitation in the next 30 days, 69th percentile

Published

2020-09-09

Updated

2024-08-04

Proof-of-concept exploits (1)

• alwentiu/CVE-2020-142920★ · 2020-09-08

References

• CVE Record
• NVD entry

Related

• CVE-2020-12856
• CVE-2020-35693
• CVE-2020-14209
• CVE-2020-14293
• CVE-2020-14201
• CVE-2020-14294