CVE-2020-12270

MEDIUM 6.5CVE-2020-12270 · Published 27/04/2020 · updated 17/06/2026

In short

CVE-2020-12270 is a MEDIUM (CVSS 6.5) vulnerability affecting bluezone (bluezone).
Chance of exploitation in the next 30 days (EPSS): 1.4%, higher than 73.3% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
bluezone bluezone	`= 1.0.0`	No fix yet

Description

React Native Bluetooth Scan in Bluezone 1.0.0 uses six-character alphanumeric IDs, which might make it easier for remote attackers to interfere with COVID-19 contact tracing by using many IDs. NOTE: the vendor disputes the relevance of this report because the recipient of an F1 alert will know it was a false alert if contact-history comparison fails (i.e., an F0 is not actually part of the contact history obtained from the device of this recipient, or this recipient is not actually part of the contact history obtained from the device of an F0)

References

bluezone.ai/CVE
BluezoneGlobal/bluezone-app · Release Notes
BluezoneGlobal/bluezone-app · Third Party Advisory
BluezoneGlobal/react-native-bluetooth-scan · Third Party Advisory
BluezoneGlobal/react-native-bluetooth-scan · Third Party Advisory
BluezoneGlobal/react-native-bluetooth-scan · Third Party Advisory
vnhacker.blogspot.com/2020/04/vietnams-contact-tracing-app_26.html · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free