CVE-2020-13702

The Rolling Proximity Identifier used in the Apple/Google Exposure Notification API beta through 2020-05-29 enables attackers to circumvent Bluetooth Smart Privacy because there is a secondary temporary UID. An attacker with access to Beacon or IoT networks can seamlessly track individual device movement via a Bluetooth LE discovery mechanism.

• CWE-200

• https://blog.google/documents/70/Exposure_Notification_-_Bluetooth_Specification_v1.2.2.pdfThird Party Advisory
• https://github.com/google/exposure-notifications-internals/commit/8f751a666697Patch, Third Party Advisory
• https://github.com/google/exposure-notifications-internals/commit/8f751a666697c3cae0a56ae3464c2c6cbe31b69ePatch, Third Party Advisory
• https://github.com/normanluhrmann/infosec/raw/master/exposure-notification-vulnerability-20200611.pdfExploit, Technical Description, Third Party Advisory
• https://github.com/normanluhrmann/infosec/raw/master/exposure-notification-vulnerability-20200616-2.pdfExploit, Technical Description, Third Party Advisory
• https://github.com/normanluhrmann/infosec/raw/master/exposure-notification-vulnerability-20200616.pdfExploit, Technical Description, Third Party Advisory
• https://blog.google/documents/70/Exposure_Notification_-_Bluetooth_Specification_v1.2.2.pdfThird Party Advisory
• https://github.com/google/exposure-notifications-internals/commit/8f751a666697Patch, Third Party Advisory
• https://github.com/google/exposure-notifications-internals/commit/8f751a666697c3cae0a56ae3464c2c6cbe31b69ePatch, Third Party Advisory
• https://github.com/normanluhrmann/infosec/raw/master/exposure-notification-vulnerability-20200611.pdfExploit, Technical Description, Third Party Advisory
• https://github.com/normanluhrmann/infosec/raw/master/exposure-notification-vulnerability-20200616-2.pdfExploit, Technical Description, Third Party Advisory
• https://github.com/normanluhrmann/infosec/raw/master/exposure-notification-vulnerability-20200616.pdfExploit, Technical Description, Third Party Advisory

Published

Jun 11, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-13695In QuickBox Community Edition through 2.5.5 and Pro Edition …7.2
• CVE-2020-13696An issue was discovered in LinuxTV xawtv before 3.107. The f…4.4
• CVE-2020-13697An issue was discovered in RouterNanoHTTPD.java in NanoHTTPD…6.1
• CVE-2020-13699TeamViewer Desktop for Windows before 15.8.3 does not proper…8.8
• CVE-2020-1370An elevation of privilege vulnerability exists when the Wind…7.8
• CVE-2020-13700An issue was discovered in the acf-to-rest-api plugin throug…7.5
• CVE-2020-1371An elevation of privilege vulnerability exists when the Wind…7.8
• CVE-2020-13712A command injection is possible through the user interface, …7.8
• CVE-2020-13713Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-13714Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-13715Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-13716Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…