CVE-2020-13702

CRITICAL 10.0CVE-2020-13702 · Published 11/06/2020 · updated 17/06/2026

In short

CVE-2020-13702 is a CRITICAL (CVSS 10.0) vulnerability affecting the rolling proximity identifier (the rolling proximity identifier project).
Chance of exploitation in the next 30 days (EPSS): 2.2%, higher than 82.8% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
the rolling proximity identifier the_rolling_proximity_identifier_project	`≤ 2020-05-29`	No fix yet

Description

The Rolling Proximity Identifier used in the Apple/Google Exposure Notification API beta through 2020-05-29 enables attackers to circumvent Bluetooth Smart Privacy because there is a secondary temporary UID. An attacker with access to Beacon or IoT networks can seamlessly track individual device movement via a Bluetooth LE discovery mechanism.

References

blog.google/documents/70/Exposure_Notification_-_Bluetooth_Specification_v1.2.2.pdf · Third Party Advisory
google/exposure-notifications-internals commit 8f751a6 · Patch
google/exposure-notifications-internals commit 8f751a6 · Patch
normanluhrmann/infosec · Exploit
normanluhrmann/infosec · Exploit
normanluhrmann/infosec · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free