QwikSec

Security Database

CVE

CWE

Training

CVE-2020-15509

Published: Jul 7, 2020

Modified: Aug 4, 2024

PUBLISHED

Description

Nordic Semiconductor Android BLE Library through 2.2.1 and DFU Library through 1.10.4 for Android (as used by nRF Connect and other applications) can engage in unencrypted communication while showing the user that the communication is purportedly encrypted. The problem is in bond creation (e.g., internalCreateBond in BleManagerHandler).

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

https://github.com/NordicSemiconductor/Android-BLE-Library/commits/master

x_refsource_MISC

https://github.com/NordicSemiconductor/Android-DFU-Library/commits/release

x_refsource_MISC

https://secretdiary.ninja/index.php/2020/07/03/norec-attack-stripping-ble-encryption-from-nordicsemis-android-library-cve-2020-15509/

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.