GCVE - cpe:2.3:a:bluetooth:mesh_profile:1.0.1:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:bluetooth:mesh_profile:1.0.1:*:*:*:*:*:*:*

part: a version: 1.0.1 update: *

Vendor	Bluetooth (`31cd545d-f1e7-5dd7-811d-c914bae37aab`)
Product	Mesh Profile (`04da259b-1f10-5ded-8632-6cdf80b24bd0`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2020-26560`	vulnerable	2026-06-08 05:23:51.327156	Details available Bluetooth Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device, reflecting the authentication evidence from a Provisioner, to complete authentication without possessing the AuthValue, and potentially acquire a NetKey and AppKey. Published: 2021-05-24T17:06:57.000Z Updated: 2025-11-04T19:12:21.032Z Open on db.gcve.eu Reference links https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/reporting-security/ https://kb.cert.org/vuls/id/799380	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-26559`	vulnerable	2026-06-08 05:23:51.326482	Details available Bluetooth Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device (participating in the provisioning protocol) to identify the AuthValue used given the Provisioner’s public key, and the confirmation number and nonce provided by the provisioning device. This could permit a device without the AuthValue to complete provisioning without brute-forcing the AuthValue. Published: 2021-05-24T17:13:12.000Z Updated: 2025-11-04T19:12:19.938Z Open on db.gcve.eu Reference links https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/reporting-security/ https://kb.cert.org/vuls/id/799380	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-26557`	vulnerable	2026-06-08 05:23:51.316488	Details available Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device (without possession of the AuthValue used in the provisioning protocol) to determine the AuthValue via a brute-force attack (unless the AuthValue is sufficiently random and changed each time). Published: 2021-05-24T17:28:56.000Z Updated: 2025-11-04T19:12:17.663Z Open on db.gcve.eu Reference links https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/reporting-security/ https://kb.cert.org/vuls/id/799380	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-26556`	vulnerable	2026-06-08 05:23:51.315816	Details available Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device, able to conduct a successful brute-force attack on an insufficiently random AuthValue before the provisioning procedure times out, to complete authentication by leveraging Malleable Commitment. Published: 2021-05-24T17:34:58.000Z Updated: 2024-08-04T15:56:04.887Z Open on db.gcve.eu Reference links https://www.kb.cert.org/vuls/id/799380 https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/reporting-security/ https://kb.cert.org/vuls/id/799380	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.