Vulnerability CVE-2020-15509
Published: 2020-07-07

Description:
Nordic Semiconductor Android BLE Library through 2.2.1 and DFU Library through 1.10.4 for Android (as used by nRF Connect and other applications) can engage in unencrypted communication while showing the user that the communication is purportedly encrypted. The problem is in bond creation (e.g., internalCreateBond in BleManagerHandler).

Type:

CWE-311

 (Missing Encryption of Sensitive Data)

CVSS2 => (AV:A/AC:L/Au:N/C:P/I:N/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
3.3/10
2.9/10
6.5/10
Exploit range
Attack complexity
Authentication
Adjacent network
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
None
None
Affected software
Nordicsemi -> Android ble library 
Nordicsemi -> Dfu library 

 References:
https://github.com/NordicSemiconductor/Android-BLE-Library/commits/master
https://github.com/NordicSemiconductor/Android-DFU-Library/commits/release
https://secretdiary.ninja/index.php/2020/07/03/norec-attack-stripping-ble-encryption-from-nordicsemis-android-library-cve-2020-15509/
Copyright 2024, cxsecurity.com

 

Back to Top