TI-2020-08190 Aliases CVE-2020-10135 GHSA-mg6c-h9c4-rcc2

Bluetooth devices supporting BR/EDR v5.2 and earlier are vulnerable to impersonation attacks

LOW 29CWE-757Published 2020-05-19 · Updated 2024-09-17

Key facts

Attack vector: Adjacent network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: Low · Low · None
Fix status: Partial Red Hat: 5 fixed, 6 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-290.

Summary

Legacy pairing and secure-connections pairing authentication in Bluetooth BR/EDR Core Specification v5.2 and earlier may allow an unauthenticated user to complete authentication without pairing credentials via adjacent access. An unauthenticated, adjacent attacker could impersonate a Bluetooth BR/EDR master or slave to pair with a previously paired remote device to successfully complete the authentication procedure without knowing the link key.

Why it matters now

EPSS 0.02386 84th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Partial Red Hat: 1 advisoryRed Hat: 5 fixed, 6 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Bluetooth	BR/EDR	5.2 – 5.2	—	No fix listed	CNA

BR/EDR VendorBluetooth Affected 5.2 – 5.2 Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:bluetooth:bluetooth_core:::::br:::*	up to 5.2	Vulnerable	Bluetooth
cpe:2.3:a:bluetooth:bluetooth_core:::::edr:::*	up to 5.2	Vulnerable	Bluetooth
cpe:2.3:o:opensuse:leap:15.1:::::::*	15.1	Vulnerable	openSUSE

cpe:2.3:a:bluetooth:bluetooth_core:*:*:*:*:br:*:*:* Versions up to 5.2 Vulnerable ·Bluetooth
cpe:2.3:a:bluetooth:bluetooth_core:*:*:*:*:edr:*:*:* Versions up to 5.2 Vulnerable ·Bluetooth
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE

Remediation

Red Hat 1 advisory

RHSA-2024:9315 Released 2024-11-12 · Red Hat rating Moderate
kernel security update
- Red Hat CodeReady Linux Builder (v. 9) kernel-cross-headers-5.14.0-503.11.1.el9_5, kernel-tools-libs-devel-5.14.0-503.11.1.el9_5, libperf-5.14.0-503.11.1.el9_5
- Red Hat Enterprise Linux AppStream (v. 9) kernel-64k-debug-devel-5.14.0-503.11.1.el9_5, kernel-64k-debug-devel-matched-5.14.0-503.11.1.el9_5, kernel-64k-devel-5.14.0-503.11.1.el9_5 +12
- Red Hat Enterprise Linux BaseOS (v. 9) bpftool-7.4.0-503.11.1.el9_5, kernel-5.14.0-503.11.1.el9_5, kernel-64k-5.14.0-503.11.1.el9_5 +30
- Red Hat Enterprise Linux Real Time (v. 9) kernel-rt-5.14.0-503.11.1.el9_5, kernel-rt-core-5.14.0-503.11.1.el9_5, kernel-rt-debug-5.14.0-503.11.1.el9_5 +9
- Red Hat Enterprise Linux Real Time for NFV (v. 9) kernel-rt-5.14.0-503.11.1.el9_5, kernel-rt-core-5.14.0-503.11.1.el9_5, kernel-rt-debug-5.14.0-503.11.1.el9_5 +11

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 5	Affected	No fix planned: Out of support scope
Red Hat Enterprise Linux 6	Affected	No fix planned: Out of support scope
Red Hat Enterprise Linux 7	Affected	No fix planned: Will not fix
Red Hat Enterprise Linux 8	Affected	No fix planned: Will not fix
Red Hat Enterprise Linux 9	Affected	No fix yet
Red Hat Enterprise MRG 2	Affected	No fix planned: Out of support scope
Red Hat CodeReady Linux Builder (v. 9)	Fixed	RHSA-2024:9315
Red Hat Enterprise Linux AppStream (v. 9)	Fixed	RHSA-2024:9315
Red Hat Enterprise Linux BaseOS (v. 9)	Fixed	RHSA-2024:9315
Red Hat Enterprise Linux Real Time (v. 9)	Fixed	RHSA-2024:9315
Red Hat Enterprise Linux Real Time for NFV (v. 9)	Fixed	RHSA-2024:9315

Not affected: 2 products

Red Hat CodeReady Linux Builder (v. 9)
Red Hat Enterprise Linux AppStream (v. 9)

Timeline

2026-10-02 Threatist record created from CVE-2020-10135
2026-10-03 Alias added: GHSA-mg6c-h9c4-rcc2

References

Exploit 1

20200602 BIAS (Bluetooth Impersonation Attack) CVE 2020-10135 reproduction

Advisory 6

TI-2020-08189 Bluetooth devices supporting LE and specific BR/EDR implementations are vulnerable to method confusion attacks CVSS 3.1MEDIUM 6.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences