CVE-2020-13702

CriticalCVSS 10.0/10Last modified Jun 17, 2026

Description

The Rolling Proximity Identifier used in the Apple/Google Exposure Notification API beta through 2020-05-29 enables attackers to circumvent Bluetooth Smart Privacy because there is a secondary temporary UID. An attacker with access to Beacon or IoT networks can seamlessly track individual device movement via a Bluetooth LE discovery mechanism.

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://blog.google/documents/70/Exposure_Notification_-_Bluetooth_Specification_v1.2.2.pdfThird Party Advisory
https://github.com/google/exposure-notifications-internals/commit/8f751a666697Patch, Third Party Advisory
https://github.com/google/exposure-notifications-internals/commit/8f751a666697c3cae0a56ae3464c2c6cbe31b69ePatch, Third Party Advisory
https://github.com/normanluhrmann/infosec/raw/master/exposure-notification-vulnerability-20200611.pdfExploit, Technical Description, Third Party Advisory
https://github.com/normanluhrmann/infosec/raw/master/exposure-notification-vulnerability-20200616-2.pdfExploit, Technical Description, Third Party Advisory
https://github.com/normanluhrmann/infosec/raw/master/exposure-notification-vulnerability-20200616.pdfExploit, Technical Description, Third Party Advisory
https://blog.google/documents/70/Exposure_Notification_-_Bluetooth_Specification_v1.2.2.pdfThird Party Advisory
https://github.com/google/exposure-notifications-internals/commit/8f751a666697Patch, Third Party Advisory
https://github.com/google/exposure-notifications-internals/commit/8f751a666697c3cae0a56ae3464c2c6cbe31b69ePatch, Third Party Advisory
https://github.com/normanluhrmann/infosec/raw/master/exposure-notification-vulnerability-20200611.pdfExploit, Technical Description, Third Party Advisory
https://github.com/normanluhrmann/infosec/raw/master/exposure-notification-vulnerability-20200616-2.pdfExploit, Technical Description, Third Party Advisory
https://github.com/normanluhrmann/infosec/raw/master/exposure-notification-vulnerability-20200616.pdfExploit, Technical Description, Third Party Advisory

Timeline

Published: Jun 11, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-13717.8An elevation of privilege vulnerability exists when the Windows Event Logging Service improperly handles memory.To exploit this vulnerabilit CVE-2020-137127.8A command injection is possible through the user interface, allowing arbitrary command execution as the root user. oMG2000 running MGOS 3.1 CVE-2020-13727.8An elevation of privilege vulnerability exists when Windows Mobile Device Management (MDM) Diagnostics improperly handles objects in memory,CVE-2020-13737.8An elevation of privilege vulnerability exists in the way that the Windows Network Connections Service handles objects in memory, aka 'Windo CVE-2020-13747.5A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious server, aka 'Remote De CVE-2020-13757.8An elevation of privilege vulnerability exists when Windows improperly handles COM object creation, aka 'Windows COM Server Elevation of Pri CVE-2020-1375310.0The bubblewrap sandbox of WebKitGTK and WPE WebKit, prior to 2.28.3, failed to properly block access to CLONE_NEWUSER and the TIOCSTI ioctl.CVE-2020-137546.7hw/pci/msix.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access via a crafted address in an msi-x mmio operation.CVE-2020-137569.8Sabberworm PHP CSS Parser before 8.3.1 calls eval on uncontrolled data, possibly leading to remote code execution if the function allSelecto CVE-2020-137577.5Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.CVE-2020-137586.1modules/security/classes/general.post_filter.php/post_filter.php in the Web Application Firewall in Bitrix24 through 20.0.950 allows XSS by CVE-2020-137597.5rust-vmm vm-memory before 0.1.1 and 0.2.x before 0.2.1 allows attackers to cause a denial of service (loss of IP networking) because read_ob