CVE-2020-12270

React Native Bluetooth Scan in Bluezone 1.0.0 uses six-character alphanumeric IDs, which might make it easier for remote attackers to interfere with COVID-19 contact tracing by using many IDs. NOTE: the vendor disputes the relevance of this report because the recipient of an F1 alert will know it was a false alert if contact-history comparison fails (i.e., an F0 is not actually part of the contact history obtained from the device of this recipient, or this recipient is not actually part of the contact history obtained from the device of an F0)

• CWE-330

• https://bluezone.ai/CVE
• https://github.com/BluezoneGlobal/bluezone-app/blob/afa15fcec391f0edc51d0486a4ca84dd2520bbb3/CHANGELOG.mdRelease Notes, Third Party Advisory
• https://github.com/BluezoneGlobal/bluezone-app/blob/afa15fcec391f0edc51d0486a4ca84dd2520bbb3/package.json#L27Third Party Advisory
• https://github.com/BluezoneGlobal/react-native-bluetooth-scan/blob/d9ee70fd594093a30e50b6e62a7593a8397c2dab/lib/android/src/main/AndroidManifest.xml#L11-L12Third Party Advisory
• https://github.com/BluezoneGlobal/react-native-bluetooth-scan/blob/d9ee70fd594093a30e50b6e62a7593a8397c2dab/lib/android/src/main/java/com/scan/BluezonerIdGenerator.java#L18-L28Third Party Advisory
• https://github.com/BluezoneGlobal/react-native-bluetooth-scan/blob/d9ee70fd594093a30e50b6e62a7593a8397c2dab/lib/android/src/main/java/com/scan/TraceCovidModule.java#L98Third Party Advisory
• https://vnhacker.blogspot.com/2020/04/vietnams-contact-tracing-app_26.htmlExploit, Third Party Advisory
• https://bluezone.ai/CVE
• https://github.com/BluezoneGlobal/bluezone-app/blob/afa15fcec391f0edc51d0486a4ca84dd2520bbb3/CHANGELOG.mdRelease Notes, Third Party Advisory
• https://github.com/BluezoneGlobal/bluezone-app/blob/afa15fcec391f0edc51d0486a4ca84dd2520bbb3/package.json#L27Third Party Advisory
• https://github.com/BluezoneGlobal/react-native-bluetooth-scan/blob/d9ee70fd594093a30e50b6e62a7593a8397c2dab/lib/android/src/main/AndroidManifest.xml#L11-L12Third Party Advisory
• https://github.com/BluezoneGlobal/react-native-bluetooth-scan/blob/d9ee70fd594093a30e50b6e62a7593a8397c2dab/lib/android/src/main/java/com/scan/BluezonerIdGenerator.java#L18-L28Third Party Advisory
• https://github.com/BluezoneGlobal/react-native-bluetooth-scan/blob/d9ee70fd594093a30e50b6e62a7593a8397c2dab/lib/android/src/main/java/com/scan/TraceCovidModule.java#L98Third Party Advisory
• https://vnhacker.blogspot.com/2020/04/vietnams-contact-tracing-app_26.htmlExploit, Third Party Advisory

Published

Apr 27, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-12262Intelbras TIP200 60.61.75.15, TIP200LITE 60.61.75.15, and TI…5.4
• CVE-2020-12265The decompress package before 4.2.1 for Node.js is vulnerabl…9.8
• CVE-2020-12266An issue was discovered where there are multiple externally …7.5
• CVE-2020-12267setMarkdown in Qt before 5.14.2 has a use-after-free related…9.8
• CVE-2020-12268jbig2_image_compose in jbig2_image.c in Artifex jbig2dec bef…9.8
• CVE-2020-1227<p>A cross-site-scripting (XSS) vulnerability exists when Mi…5.4
• CVE-2020-12271A SQL injection issue was found in SFOS 17.0, 17.1, 17.5, an…9.8
• CVE-2020-12272OpenDMARC through 1.3.2 and 1.4.x allows attacks that inject…5.3
• CVE-2020-12273In TestLink 1.9.20, a crafted login.php viewer parameter exp…7.5
• CVE-2020-12274In TestLink 1.9.20, the lib/cfields/cfieldsExport.php goback…9.8
• CVE-2020-12275GitLab 12.6 through 12.9 is vulnerable to a privilege escala…5.3
• CVE-2020-12276GitLab 9.5.9 through 12.9 is vulnerable to stored XSS in an …4.8