CVE-2020-26555

—

CVSS 3.1

5.4 medium

EPSS

<1%p57

Published

May 24, 2021 (May 24, 2021)

Modified

Jun 17, 2026

Description

Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B through 5.2 may permit an unauthenticated nearby device to spoof the BD_ADDR of the peer device to complete pairing without knowledge of the PIN.

Vendors: bluetooth fedoraproject intel
Products: bluetooth core specification, fedora, ax210 firmware, ax201 firmware, ax200 firmware, ac 9560 firmware, ac 9462 firmware, ac 9461 firmware, ac 9260 firmware, ac 8265 firmware, ac 8260 firmware, ac 3168 firmware
Weakness: CWE-863
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.9%)

In the news2 stories

New Bluetooth Flaws Let Attackers Impersonate Legitimate Devices

The Hacker NewsMay 28, 03:54 UTC · May 28, 2021Vulnerability CVE-2020-26555 CVE-2020-26558 CVE-2020-26556+3 CVEs

French intel found flaws in Bluetooth Core and Mesh specs

Security AffairsMay 24, 21:55 UTC · May 24, 2021Vulnerability CVE-2020-26559 CVE-2020-26556 CVE-2020-26557+3 CVEs