CVE-2020-26559

HIGH

Bluetooth Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device (participating in the provisioning protocol) to identify the AuthValue used given the Provisioner’...

Affects 1 product across 1 vendor.

CVSS 3.18.8
EPSS0.9%
Percentile57th
PatchUnknown
CVSS Vector — Plain English Exploitable from adjacent network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-863: Incorrect Authorization

Software performs an authorization check incorrectly, allowing access beyond intended privileges.

◆ AI Analysis — automated analysis, not human-reviewed

A vulnerability in the Bluetooth Mesh Provisioning protocol of Bluetooth Mesh profile 1.0 and 1.0.1 allows a nearby device to identify the AuthValue used during provisioning, potentially allowing unauthorized provisioning without brute-forcing the AuthValue.

BSID: BS-2021-GLOBAL-149417-H • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2020-26559?
A vulnerability in the Bluetooth Mesh Provisioning protocol of Bluetooth Mesh profile 1.0 and 1.0.1 allows a nearby device to identify the AuthValue used during provisioning, potentially allowing unauthorized provisioning without brute-forcing the AuthValue.
What is the CVSS score for CVE-2020-26559?
CVE-2020-26559 has CVSS 8.8 (High). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS: 0.9%.
Is CVE-2020-26559 actively exploited?
No confirmed active exploitation of CVE-2020-26559 as of 2026-09-25.
How do I remediate CVE-2020-26559?
Priority: IMMEDIATE. Advisory: https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/reporting-security/ PSIRT: [email protected]
What systems are affected by CVE-2020-26559?
CVE-2020-26559 affects Bluetooth Mesh Profile.
Vulnerability Details
CVE IDCVE-2020-26559
BSIDBS-2021-GLOBAL-149417-H BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published2021-05-24
Last Modified2026-06-17
ICS Relevance15%
Weakness (CWE)
Incorrect Authorization
SourceNVD
Official Description

Bluetooth Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device (participating in the provisioning protocol) to identify the AuthValue used given the Provisioner’s public key, and the confirmation number and nonce provided by the provisioning device. This could permit a device without the AuthValue to complete provisioning without brute-forcing the AuthValue.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The attack involves a nearby device participating in the provisioning protocol to identify the AuthValue using the Provisioner’s public key, the confirmation number, and the nonce provided by the provisioning device. This could enable unauthorized devices to complete the provisioning process without the correct AuthValue.

Exploitation Likelihood: HIGH

Affected Products
VendorProductAffected Versions
Bluetooth Mesh Profile 1.0.0 1.0.1
Remediation
View Vendor Advisory →

Remediation Priority: IMMEDIATE

Vendor PSIRT: [email protected]
Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 1970 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hash6a9ca46612190196e120c7541df7539ace484f3c278ed35ae154cbfbba540f050c29dbf92fe5d728fbb9d36e38bfb88d393faac19a27f901c70408f8b2002d52
Related CVEs affecting Bluetooth
CVE-2023-7017 9.8 Sciener locks' firmware update mechanism do not authenticate or validate firm... CVE-2025-9994 9.8 The Amp’ed RF BT-AP 111 Bluetooth access point's HTTP admin interface does no... CVE-2025-14346 9.8 WHILL Model C2 Electric Wheelchairs and Model F Power Chairs do not enforce a... CVE-2025-32059 8.8 The specific flaw exists within the Bluetooth stack developed by Alps Alpine ... CVE-2025-32062 8.8 The specific flaw exists within the Bluetooth stack developed by Alps Alpine ...
View all Bluetooth CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →