CVE-2020-26559

—

CVSS 3.1

8.8 high

EPSS

<1%p56

Published

May 24, 2021 (May 24, 2021)

Modified

Jun 17, 2026

Description

Bluetooth Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device (participating in the provisioning protocol) to identify the AuthValue used given the Provisioner’s public key, and the confirmation number and nonce provided by the provisioning device. This could permit a device without the AuthValue to complete provisioning without brute-forcing the AuthValue.

Vendors: bluetooth
Products: mesh profile
Weakness: CWE-863
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.9%)

In the news2 stories

New Bluetooth Flaws Let Attackers Impersonate Legitimate Devices

The Hacker NewsMay 28, 03:54 UTC · May 28, 2021Vulnerability CVE-2020-26555 CVE-2020-26558 CVE-2020-26556+3 CVEs

French intel found flaws in Bluetooth Core and Mesh specs

Security AffairsMay 24, 21:55 UTC · May 24, 2021Vulnerability CVE-2020-26559 CVE-2020-26556 CVE-2020-26557+3 CVEs