CVE-2020-13595

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The Bluetooth Low Energy (BLE) controller implementation in Espressif ESP-IDF 4.0 through 4.2 (for ESP32 devices) returns the wrong number of completed BLE packets and triggers a reachable assertion on the host stack when receiving a packet with an MIC failure. An attacker within radio range can silently trigger the assertion (which disables the target's BLE stack) by sending a crafted sequence of BLE packets.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-617

Affected software

No affected versions have been published.

Timeline

Published
Aug 31, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-135966.1An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. Query parameters generated by the Django admin ForeignKeyRawIdWidgCVE-2020-135973.5Clusters using Calico (version 3.14.0 and below), Calico Enterprise (version 2.8.2 and below), may be vulnerable to information disclosure iCVE-2020-135987.8FS: Buffer Overflow when enabling Long File Names in FAT_FS and calling fs_stat. Zephyr versions >= v1.14.2, >= v2.3.0 contain Stack-based BCVE-2020-135993.3Security problem with settings and littlefs. Zephyr versions >= 1.14.2, >= 2.3.0 contain Incorrect Default Permissions (CWE-276). For more iCVE-2020-13607.8An elevation of privilege vulnerability exists when the Windows Profile Service improperly handles file operations, aka 'Windows Profile SerCVE-2020-136007.6Malformed SPI in response for eswifi can corrupt kernel memory. Zephyr versions >= 1.14.2, >= 2.3.0 contain Heap-based Buffer Overflow (CWE-CVE-2020-136019.8Possible read out of bounds in dns read. Zephyr versions >= 1.14.2, >= 2.3.0 contain Out-of-bounds Read (CWE-125). For more information, seeCVE-2020-136025.5Remote Denial of Service in LwM2M do_write_op_tlv. Zephyr versions >= 1.14.2, >= 2.2.0 contain Improper Input Validation (CWE-20), Loop withCVE-2020-136037.8Integer Overflow in memory allocating functions. Zephyr versions >= 1.14.2, >= 2.4.0 contain Integer Overflow or Wraparound (CWE-190). For mCVE-2020-13615.5An information disclosure vulnerability exists in the way that the WalletService handles memory.To exploit the vulnerability, an attacker woCVE-2020-136145.9An issue was discovered in ssl.c in Axel before 2.17.8. The TLS implementation lacks hostname verification.CVE-2020-136155.9lib/QoreSocket.cpp in Qore before 0.9.4.2 lacks hostname verification for X.509 certificates.