CVE-2020-24722

MEDIUM 5.9CVE-2020-24722 · Published 07/10/2020 · updated 17/06/2026

In short

CVE-2020-24722 is a MEDIUM (CVSS 5.9) vulnerability affecting exposure notifications (exposure notifications project).
Chance of exploitation in the next 30 days (EPSS): 2.5%, higher than 84.6% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
exposure notifications exposure_notifications_project	`≤ 2020-10-05`	No fix yet

Description

An issue was discovered in the GAEN (aka Google/Apple Exposure Notifications) protocol through 2020-10-05, as used in COVID-19 applications on Android and iOS. The encrypted metadata block with a TX value lacks a checksum, allowing bitflipping to amplify a contamination attack. This can cause metadata deanonymization and risk-score inflation. NOTE: the vendor's position is "We do not believe that TX power authentication would be a useful defense against relay attacks.

References

packetstormsecurity.com/files/159496/GAEN-Protocol-Metadata-Deanonymization-Risk-Score-Inflation.html · Exploit
seclists.org/fulldisclosure/2020/Oct/12 · Exploit
blog.google/inside-google/company-announcements/update-exposure-notifications · Third Party Advisory
google/exposure-notifications-internals · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free