CVE-2020-15802

Devices supporting Bluetooth before 5.1 may allow man-in-the-middle attacks, aka BLURtooth. Cross Transport Key Derivation in Bluetooth Core Specification v4.2 and v5.0 may permit an unauthenticated user to establish a bonding with one transport, either LE or BR/EDR, and replace a bonding already established on the opposing transport, BR/EDR or LE, potentially overwriting an authenticated key with an unauthenticated key, or a key with greater entropy with one with less.

• CWE-287

• https://gizmodo.com/bluetooth-unveils-its-latest-security-issue-with-no-se-1845013709Third Party Advisory
• https://www.bluetooth.com/learn-about-bluetooth/bluetooth-technology/bluetooth-security/blurtooth/Vendor Advisory
• https://www.kb.cert.org/vuls/id/589825Third Party Advisory, US Government Resource
• https://gizmodo.com/bluetooth-unveils-its-latest-security-issue-with-no-se-1845013709Third Party Advisory
• https://www.bluetooth.com/learn-about-bluetooth/bluetooth-technology/bluetooth-security/blurtooth/Vendor Advisory
• https://www.kb.cert.org/vuls/id/589825Third Party Advisory, US Government Resource

Published

Sep 11, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-15797A vulnerability has been identified in DCA Vantage Analyzer …6.8
• CVE-2020-15798A vulnerability has been identified in SIMATIC HMI Comfort P…9.8
• CVE-2020-15799A vulnerability has been identified in SCALANCE X-200 switch…6.5
• CVE-2020-1580A cross-site-scripting (XSS) vulnerability exists when Micro…5.4
• CVE-2020-15800A vulnerability has been identified in SCALANCE X-200 switch…9.8
• CVE-2020-15801In Python 3.8.4, sys.path restrictions specified in a python…9.8
• CVE-2020-15803Zabbix before 3.0.32rc1, 4.x before 4.0.22rc1, 4.1.x through…6.1
• CVE-2020-15806CODESYS Control runtime system before 3.5.16.10 allows Uncon…7.5
• CVE-2020-15807GNU LibreDWG before 0.11 allows NULL pointer dereferences vi…6.5
• CVE-2020-15809spxmanage on certain SpinetiX devices allows requests that a…6.5
• CVE-2020-1581An elevation of privilege vulnerability exists in the way th…7.8
• CVE-2020-15810An issue was discovered in Squid before 4.13 and 5.x before …6.5