High severity · published Mar 12, 2020
CVE-2020-0556
Improper access control in subsystem for BlueZ before version 5.54 may allow an unauthenticated user to potentially enable escalation of privilege and denial of service via…
7.1
CVSS
1%
EPSS
No
On KEV
Description
Improper access control in subsystem for BlueZ before version 5.54 may allow an unauthenticated user to potentially enable escalation of privilege and denial of service via adjacent access
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 64% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BL
Bluez · Bluez
before 5.54 · source: NVD
DL
Debian Linux · Debian
8.0; 9.0; 10.0 · source: NVD
LE
Leap · Opensuse
15.1; 15.2 · source: NVD
UL
Ubuntu Linux · Canonical
16.04; 18.04; 19.10 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-0556
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-0556
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00008.html
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00055.html
Mailing List
https://lists.debian.org/debian-lts-announce/2020/06/msg00008.html
Third Party Advisory
https://security.gentoo.org/glsa/202003-49
Third Party Advisory
https://usn.ubuntu.com/4311-1/
Third Party Advisory
https://www.debian.org/security/2020/dsa-4647
More from Bluez
9.1
CVE-2021-43400
An issue was discovered in gatt-database.c in BlueZ 5.61
8.8
CVE-2024-8805
BlueZ HID over GATT Profile Improper Access Control Remote Code Execution Vulnerability
8.8
CVE-2022-39177
BlueZ before 5.59 allows physically proximate attackers to cause a denial of service because malformed and invalid capabilities can be processed in profiles/audio/avdtp.c
8.8
CVE-2022-39176
BlueZ before 5.59 allows physically proximate attackers to obtain sensitive information because profiles/audio/avrcp.c does not validate params_len
8.8
CVE-2022-0204
A heap overflow vulnerability was found in bluez in versions prior to 5.63