Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B through 5.2 may permit an unauthenticated nearby device to sp…

published 2021-05-24 5 y ago modified 2026-06-17 4 mo ago also EUVD-2020-19100

cvss: 5.4; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.9%; EPSS 0.9% chance of exploitation in 30 days, percentile 59%
public exploits: 0; none known

Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B through 5.2 may permit an unauthenticated nearby device to spoof the BD_ADDR of the peer device to complete pairing without knowledge of the PIN.

Patch / fix

distros 5

ubuntu red hat suse almalinux rocky linux

linux Ubuntu 18.04 LTS 4.15.0-151.157
linux Ubuntu 20.04 LTS 5.4.0-80.90
linux-aws Ubuntu 18.04 LTS 4.15.0-1109.116
linux-aws Ubuntu 20.04 LTS 5.4.0-1054.57
linux-gcp Ubuntu 20.04 LTS 5.4.0-1049.53
linux-gke Ubuntu 20.04 LTS 5.4.0-1049.52
linux-kvm Ubuntu 18.04 LTS 4.15.0-1097.99
linux-kvm Ubuntu 20.04 LTS 5.4.0-1044.46

ubuntu advisories UBUNTU-CVE-2020-26555

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

kernel RHEL 8 4.18.0-553.8.1.el8_10
perf RHEL 8 4.18.0-553.8.1.el8_10
bpftool RHEL 8 4.18.0-553.8.1.el8_10
kernel-core RHEL 8 4.18.0-553.8.1.el8_10
kernel-tools RHEL 8 4.18.0-553.8.1.el8_10
python3-perf RHEL 8 4.18.0-553.8.1.el8_10
kernel-modules RHEL 8 4.18.0-553.8.1.el8_10
kernel-zfcpdump RHEL 8 4.18.0-553.8.1.el8_10

red hat advisories RHSA-2024:4211 RHSA-2024:4352 RHSA-2024:2394

dtb-aarch64 openSUSE Leap 15.5 5.14.21-150500.55.44.1
kernel-64kb SLE Module for Basesystem 15 SP5, openSUSE Leap 15.5 5.14.21-150500.55.44.1
kernel-syms SLE Module for Development Tools 15 SP5, openSUSE Leap 15.5 5.14.21-150500.55.44.1
kernel-obs-qa openSUSE Leap 15.5 5.14.21-150500.55.44.1
kernel-source SLE Module for Development Tools 15 SP5, SLE Module for Basesystem 15 SP5, openSUSE Leap 15.5 5.14.21-150500.55.44.1
kernel-default SLE Workstation Extension 15 SP5, SLE Module for Legacy 15 SP5, SLE Module for Basesystem 15 SP5 +4 more 5.14.21-150500.55.44.1
kernel-kvmsmall openSUSE Leap 15.5 5.14.21-150500.55.44.1
kernel-zfcpdump SLE Module for Basesystem 15 SP5, openSUSE Leap 15.5 5.14.21-150500.55.44.1

suse advisories SUSE-SU-2024:0160-1 SUSE-SU-2024:0156-1 SUSE-SU-2024:0154-1 SUSE-SU-2024:0153-1 SUSE-SU-2024:0141-1 SUSE-SU-2024:0129-1

kernel-rt AlmaLinux 8 4.18.0-553.8.1.rt7.349.el8_10
kernel-rt-kvm AlmaLinux 8 4.18.0-553.8.1.rt7.349.el8_10
kernel-rt-core AlmaLinux 8 4.18.0-553.8.1.rt7.349.el8_10
kernel-rt-modules AlmaLinux 8 4.18.0-553.8.1.rt7.349.el8_10
kernel-rt-debug-kvm AlmaLinux 8 4.18.0-553.8.1.rt7.349.el8_10
kernel-rt-debug-core AlmaLinux 8 4.18.0-553.8.1.rt7.349.el8_10
kernel-rt-debug-modules AlmaLinux 8 4.18.0-553.8.1.rt7.349.el8_10
kernel-rt-modules-extra AlmaLinux 8 4.18.0-553.8.1.rt7.349.el8_10

almalinux advisories ALSA-2024:4352 ALSA-2024:4211 ALSA-2024:2394

kernel-rt Rocky Linux 8 4.18.0-553.8.1.rt7.349.el8_10
kernel Rocky Linux 8 4.18.0-553.8.1.el8_10

rocky linux advisories RLSA-2024:4352 RLSA-2024:4211

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-26555 updated 2026-06-28 cvss 5.4

kernel: Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack

Red Hat Enterprise Linux 7 perf, bluez, kernel, bpftool, kernel-rt, bluez-cups, +12 more
affected: workaround, no fix planned “Out of support scope”
Red Hat Enterprise Linux 8 bluez, bluez-cups, bluez-libs, bluez-obexd, bluez-hid2hci
affected: workaround, no fix planned “Will not fix”
Red Hat Enterprise Linux 9 bluez, kernel-rt, bluez-cups, bluez-libs, bluez-obexd, kernel-rt-kvm, +16 more
affected: workaround, no fix available, no fix planned “Will not fix”
Red Hat Enterprise Linux AppStream (v. 9) rv 5.14.0-427.13.1.el9_4, perf 5.14.0-427.13.1.el9_4, rtla 5.14.0-427.13.1.el9_4, kernel-devel-matched 5.14.0-427.13.1.el9_4, kernel-64k-devel-matched 5.14.0-427.13.1.el9_4, kernel-debug-devel-matched 5.14.0-427.13.1.el9_4, +6 more
fixed: vendor fix RHSA-2024:2394
Red Hat Enterprise Linux BaseOS (v. 8) perf 4.18.0-553.8.1.el8_10, kernel 4.18.0-553.8.1.el8_10, bpftool 4.18.0-553.8.1.el8_10, kernel-core 4.18.0-553.8.1.el8_10, kernel-tools 4.18.0-553.8.1.el8_10, python3-perf 4.18.0-553.8.1.el8_10, +15 more
fixed: vendor fix RHSA-2024:4211
Red Hat Enterprise Linux BaseOS (v. 9) bpftool 7.3.0-427.13.1.el9_4, kernel 5.14.0-427.13.1.el9_4, kernel-64k 5.14.0-427.13.1.el9_4, kernel-core 5.14.0-427.13.1.el9_4, kernel-tools 5.14.0-427.13.1.el9_4, python3-perf 5.14.0-427.13.1.el9_4, +28 more
fixed: vendor fix RHSA-2024:2394
Red Hat Enterprise Linux CRB (v. 8) kernel-debuginfo-common-x86_64 4.18.0-553.8.1.el8_10, kernel-debuginfo-common-aarch64 4.18.0-553.8.1.el8_10, kernel-debuginfo-common-ppc64le 4.18.0-553.8.1.el8_10
fixed: vendor fix RHSA-2024:4211
Red Hat Enterprise Linux CRB (v. 9) libperf 5.14.0-427.13.1.el9_4, kernel-debuginfo-common-s390x 5.14.0-427.13.1.el9_4, kernel-debuginfo-common-x86_64 5.14.0-427.13.1.el9_4, kernel-debuginfo-common-aarch64 5.14.0-427.13.1.el9_4, kernel-debuginfo-common-ppc64le 5.14.0-427.13.1.el9_4
fixed: vendor fix RHSA-2024:2394

show 5 more

Red Hat Enterprise Linux NFV (v. 8) kernel-rt 4.18.0-553.8.1.rt7.349.el8_10, kernel-rt-kvm 4.18.0-553.8.1.rt7.349.el8_10, kernel-rt-core 4.18.0-553.8.1.rt7.349.el8_10, kernel-rt-modules 4.18.0-553.8.1.rt7.349.el8_10, kernel-rt-debug-kvm 4.18.0-553.8.1.rt7.349.el8_10, kernel-rt-debug-core 4.18.0-553.8.1.rt7.349.el8_10, +4 more
fixed: vendor fix RHSA-2024:4352
Red Hat Enterprise Linux NFV (v. 9) kernel-rt 5.14.0-427.13.1.el9_4, kernel-rt-kvm 5.14.0-427.13.1.el9_4, kernel-rt-core 5.14.0-427.13.1.el9_4, kernel-rt-modules 5.14.0-427.13.1.el9_4, kernel-rt-debug-kvm 5.14.0-427.13.1.el9_4, kernel-rt-debug-core 5.14.0-427.13.1.el9_4, +6 more
fixed: vendor fix RHSA-2024:2394
Red Hat Enterprise Linux RT (v. 8) kernel-rt 4.18.0-553.8.1.rt7.349.el8_10, kernel-rt-core 4.18.0-553.8.1.rt7.349.el8_10, kernel-rt-modules 4.18.0-553.8.1.rt7.349.el8_10, kernel-rt-debug-core 4.18.0-553.8.1.rt7.349.el8_10, kernel-rt-debug-modules 4.18.0-553.8.1.rt7.349.el8_10, kernel-rt-modules-extra 4.18.0-553.8.1.rt7.349.el8_10, +2 more
fixed: vendor fix RHSA-2024:4352
Red Hat Enterprise Linux RT (v. 9) kernel-rt 5.14.0-427.13.1.el9_4, kernel-rt-core 5.14.0-427.13.1.el9_4, kernel-rt-modules 5.14.0-427.13.1.el9_4, kernel-rt-debug-core 5.14.0-427.13.1.el9_4, kernel-rt-modules-core 5.14.0-427.13.1.el9_4, kernel-rt-debug-modules 5.14.0-427.13.1.el9_4, +4 more
fixed: vendor fix RHSA-2024:2394
Red Hat Enterprise Linux 5 kernel Red Hat Enterprise Linux 6 perf, bluez, kernel, bluez-alsa, bluez-cups, bluez-libs, +7 more Red Hat Enterprise Linux BaseOS (v. 8) kernel-headers 4.18.0-553.8.1.el8_10, kernel-cross-headers 4.18.0-553.8.1.el8_10
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-24-074-07 updated 2024-03-14 cvss 5.4

Siemens SIMATIC

Siemens SIMATIC RF160B (6GT2003-0FA00) <V2.2
affected: mitigation “Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.” siemens.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

0.89% chance of exploitation in the next 30 days, higher than 59% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.1	5.4	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
NVD	2.0	4.8	AV:A/AC:L/Au:N/C:P/I:P/A:N

Classification

Weakness

CWE-863 Incorrect Authorization

References

lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/NSS6CTGE4UGTJLCOZOASDR3T3SLL6QJZ/
vendor-advisory
bluetooth.com /learn-about-bluetooth/key-attributes/bluetooth-security/reporting-security/
vendor-advisory
kb.cert.org /vuls/id/799380
third-party-advisory, us-government-resource
intel.com /content/www/us/en/security-center/advisory/intel-sa-00520.html
third-party-advisory
kb.cert.org /vuls/id/799380

Sources

CVE List CVE-2020-26555
NVD CVE-2020-26555

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary