CVE-2020-10135

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Legacy pairing and secure-connections pairing authentication in Bluetooth BR/EDR Core Specification v5.2 and earlier may allow an unauthenticated user to complete authentication without pairing credentials via adjacent access. An unauthenticated, adjacent attacker could impersonate a Bluetooth BR/EDR master or slave to pair with a previously paired remote device to successfully complete the authentication procedure without knowing the link key.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-757CWE-290

Affected software

No affected versions have been published.

Timeline

Published
May 19, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-101365.3IP-in-IP protocol specifies IP Encapsulation within IP standard (RFC 2003, STD 1) that decapsulate and route IP-in-IP traffic is vulnerable CVE-2020-101376.5Z-Wave devices based on Silicon Labs 700 series chipsets using S2 do not adequately authenticate or encrypt FIND_NODE_IN_RANGE frames, allowCVE-2020-101387.8Acronis Cyber Backup 12.5 and Cyber Protect 15 include an OpenSSL component that specifies an OPENSSLDIR variable as a subdirectory within CCVE-2020-101397.8Acronis True Image 2021 includes an OpenSSL component that specifies an OPENSSLDIR variable as a subdirectory within C:\jenkins_agent\. AcroCVE-2020-10147.8An elevation of privilege vulnerability exists in the Microsoft Windows Update Client when it does not properly handle privileges, aka 'MicrCVE-2020-101407.3Acronis True Image 2021 fails to properly set ACLs of the C:\ProgramData\Acronis directory. Because some privileged processes are executed fCVE-2020-101437.8Macrium Reflect includes an OpenSSL component that specifies an OPENSSLDIR variable as C:\openssl\. Macrium Reflect contains a privileged seCVE-2020-101457.8The Adobe ColdFusion installer fails to set a secure access-control list (ACL) on the default installation directory, such as C:\ColdFusion2CVE-2020-101465.4The Microsoft Teams online service contains a stored cross-site scripting vulnerability in the displayName parameter that can be exploited oCVE-2020-101489.8The SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands. This vulnerabCVE-2020-10157.8An elevation of privilege vulnerability exists in the way that the User-Mode Power Service (UMPS) handles objects in memory, aka 'Windows ElCVE-2020-10165.5An information disclosure vulnerability exists when the Windows Push Notification Service improperly handles objects in memory, aka 'Windows
CVE-2020-10135: Medium severity, CVSS 5.4 | Vulnix