Security readout for executives and security teams
Plain-English summary
This flaw affects certain Cypress/Broadcom wireless combo chips that lack a January 2021 firmware update. A nearby attacker with some local privilege could use a Spectra-style issue to access memory, potentially affecting confidentiality, integrity, and availability at low impact levels.
Executive priority
Treat this as a targeted wireless-adjacent risk, not an emergency internet-wide issue. Prioritize firmware validation for fleets with Cypress/Broadcom wireless chips, especially unmanaged embedded or Linux-based devices.
Technical view
CVE-2020-10367 is described as memory access via a Spectra attack in certain Cypress/Broadcom wireless combo chips without the January 2021 firmware update. The CVSS 3.1 vector is AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, indicating adjacent access and low privilege are required.
Likely exposure
Exposure is most likely in devices or Linux distributions using affected Cypress/Broadcom combo-chip firmware that predates the January 2021 update. The source bundle does not provide a complete affected product or CPE list.
Exploitation context
The bundle does not show KEV listing or cite active exploitation. The attack is adjacent-access, not remote internet exposure, and requires low privileges with no user interaction. Evidence is incomplete on exploit maturity and affected device breadth.
Researcher notes
The public record is sparse: affected vendor/product fields are n/a, and the key condition is absence of the January 2021 firmware update. Avoid broad product claims without chipset and firmware confirmation.
Mitigation direction
- Verify wireless firmware is January 2021 or later where vendor guidance applies.
- Review OEM, OS vendor, and chipset vendor advisories for affected firmware packages.
- For Raspberry Pi firmware packaging, review the referenced RPi-Distro bluez-firmware commit.
- Prioritize updates on managed devices using Cypress or Broadcom combo wireless chips.
Validation and detection
- Inventory endpoints and embedded devices for Cypress or Broadcom wireless combo chips.
- Check installed wireless firmware package provenance and release date.
- Compare device firmware status with OS vendor guidance, including Red Hat where relevant.
- Confirm whether unsupported images still ship pre-January 2021 firmware.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-203: Information exposure and cloud metadata lookup
Information exposure and SSRF weaknesses can make discovery, cloud metadata, and credential material review relevant. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2020-10367 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L2.13.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Source materials
- CVE List V5 sourceCVE List V5
- https://www.informatik.tu-darmstadt.de/seemoo/team_seemoo/jiska_classen/index.en.jspCVE reference
- https://github.com/RPi-Distro/bluez-firmware/commit/8445a53ce2c51a77472b908a0c8f6f8e1fa5c37aCVE reference
- https://bugzilla.redhat.com/show_bug.cgi?id=2052676CVE reference
- https://www.informatik.tu-darmstadt.de/fb20/aktuelles_fb20/fb20_neuigkeiten/neuigkeiten_fb20_details_203136.de.jspCVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Observable Discrepancy
Observable Discrepancy represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.