dbcve.org
Bluetooth Core SpecificationApplication · Bluetooth

CVE-2020-15802

MEDIUM · 5.9 CVSS v3.1 Published 2020-09-11
Fix available
A fix is available. Upgrade to 5.1 or later.
See remediation →
68/100
Remediation priority · Elevated
Remotely reachable No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
Devices supporting Bluetooth before 5.1 may allow man-in-the-middle attacks, aka BLURtooth. Cross Transport Key Derivation in Bluetooth Core Specification v4.2 and v5.0 may permit an unauthenticated user to establish a bonding with one transport, either LE or BR/EDR, and replace a bonding already established on the opposing transport, BR/EDR or LE, potentially overwriting an authenticated key with an unauthenticated key, or a key with greater entropy with one with less.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

A vulnerability in Bluetooth Cross Transport Key Derivation (CTKD) allows an unauthenticated attacker to establish a bonding on one transport (LE or BR/EDR) and overwrite an existing bonding on the opposing transport, replacing authenticated keys with unauthenticated ones or keys with greater entropy with weaker keys, enabling man-in-the-middle attacks.

MitigationUpdate Bluetooth-enabled devices to firmware/software versions implementing Bluetooth 5.1 or later, which addresses the CTKD authentication bypass in Cross Transport Key Derivation.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
Bluetooth Core SpecificationApplication
Affected:< 5.1

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify Bluetooth stack version
    Query the Bluetooth stack or firmware version on the device. On Linux, check /proc/bluetooth/version or use 'hciconfig -v'. On Windows, check via 'btdiag.exe -vv' or Device Manager. On Android, check Settings > About Phone > Bluetooth SIG version or via 'dumpsys bluetooth_manager'. For embedded devices, consult firmware version documentation.
    Affected if The reported Bluetooth Core Specification version is below 5.1 (e.g., 5.0, 4.x)
  2. Verify CTKD support is present
    Examine Bluetooth capability flags or feature masks in the stack. On Linux, check 'hcitool feat' or LMP (Link Manager Protocol) features. Look for CTKD (Cross Transport Key Derivation) bit in extended features. For other platforms, consult vendor-specific HCI commands or API calls that query supported features.
    Affected if CTKD feature bit is set in the Bluetooth stack's supported features list
  3. Confirm dual-transport capability (LE and BR/EDR)
    Verify that both Bluetooth Low Energy (LE) and Classic (BR/EDR) transports are enabled and can coexist. On Linux, check 'hciconfig -a' for multiple adapters or dual-mode support. On Android, verify Bluetooth is not in single-mode. For IoT devices, consult documentation for Bluetooth mode support.
    Affected if Both LE and BR/EDR transports are simultaneously enabled on the same device
  4. Inspect existing bondings on both transports
    List stored bondings/pairings. On Linux, check /var/lib/bluetooth/ or use 'bluetoothctl info' for paired devices. On Windows, view via Settings > Bluetooth > Paired Devices. On Android, check Settings > Bluetooth > Paired Devices. Identify if any device is paired via both transports.
    Affected if One or more devices are bonded via both LE and BR/EDR transports (creating the condition for key overwriting)

Your device is affected if it implements Bluetooth Core Specification below version 5.1, has CTKD enabled, supports both LE and BR/EDR transports simultaneously, and maintains bondings on both transports that could be overwritten.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

From vendor data
Upgrade available Upgrade to 5.1 or later
Fixed in 5.1
Interim mitigation

Update Bluetooth-enabled devices to firmware/software versions implementing Bluetooth 5.1 or later, which addresses the CTKD authentication bypass in Cross Transport Key Derivation.

Fix this in Bluetooth Core Specification Scoped from the published advisory
  • Consultation4.0 h
  • Implementation8.0 h
  • Testing6.0 h
  • Review / QA2.0 h
20.0 hours of engineering $3,500
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $5,600.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2020-15802 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2020-15802 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data