CVE-2020-15509 - CVE House
Back to Database
Status published Medium CVE-2020-15509

Nordic Semiconductor Android BLE Library through 2.2.1 and DFU Library...

Vulnerability Description

Nordic Semiconductor Android BLE Library through 2.2.1 and DFU Library through 1.10.4 for Android (as used by nRF Connect and other applications) can engage in unencrypted communication while showing the user that the communication is purportedly encrypted. The problem is in bond creation (e.g., internalCreateBond in BleManagerHandler).

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-15509

Credits & Attribution

No credits recorded in the NVD database.

References

More from nordicsemi

View All →
CVE-2022-35624
In Nordic nRF5 SDK for Mesh 5.0, a heap overflow...
High 8.2
CVE-2022-35623
In Nordic nRF5 SDK for Mesh 5.0, a heap overflow...
High 8.2
CVE-2021-29415
The elliptic curve cryptography (ECC) hardware accelerator, part of the...
Medium 5.5
CVE-2020-27211
Nordic Semiconductor nRF52840 devices through 2020-10-19 have improper protection against...
Medium 5.7

Affected Vendor

Affected Software

android ble library, dfu library
Vulnerable Versions:
0

Timeline

Official Publish: July 7th, 2020
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.