CVE-2020-13702

KRITISCH 10.0CVE-2020-13702 · Published 11/06/2020 · updated 17/06/2026

Kurz gesagt

CVE-2020-13702 ist eine Schwachstelle (KRITISCH (CVSS 10.0)) in the rolling proximity identifier (the rolling proximity identifier project).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 2.2%, höher als bei 82.8% aller Schwachstellen.
Noch keine gepatchte Version bekannt: Herstellerhinweise unter Referenzen verfolgen.

Package	Affected versions	Patched versions
the rolling proximity identifier the_rolling_proximity_identifier_project	`≤ 2020-05-29`	No fix yet

Description

The Rolling Proximity Identifier used in the Apple/Google Exposure Notification API beta through 2020-05-29 enables attackers to circumvent Bluetooth Smart Privacy because there is a secondary temporary UID. An attacker with access to Beacon or IoT networks can seamlessly track individual device movement via a Bluetooth LE discovery mechanism.

References

blog.google/documents/70/Exposure_Notification_-_Bluetooth_Specification_v1.2.2.pdf · Third Party Advisory
google/exposure-notifications-internals commit 8f751a6 · Patch
google/exposure-notifications-internals commit 8f751a6 · Patch
normanluhrmann/infosec · Exploit
normanluhrmann/infosec · Exploit
normanluhrmann/infosec · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free