Security readout for executives and security teams
Plain-English summary
This flaw can weaken Bluetooth privacy. A nearby observer may distinguish devices that should be hiding behind rotating private Bluetooth addresses by watching whether they respond to certain scan behavior. It is mainly a tracking and identification risk, not a data tampering or service outage issue.
Executive priority
Handle as a moderate privacy and tracking risk. It deserves attention for environments where BLE identity protection matters, but the sources do not support emergency response or active exploitation claims.
Technical view
CVE-2020-35473 is an information leakage side channel in Bluetooth Core Specifications 4.0 through 5.2, and extended scan response behavior in 5.0 through 5.2. The issue relates to response or non-response behavior when Resolvable Private Addressing is used, potentially linking RPAs or peers.
Likely exposure
Exposure is tied to Bluetooth Low Energy implementations based on the affected Bluetooth Core specification ranges. The provided sources do not name specific vendors, products, chipsets, operating systems, or firmware versions, so product-level exposure requires vendor confirmation.
Exploitation context
The CVSS vector indicates adjacent access, low complexity, no privileges, and no user interaction. KEV status is false in the bundle, and the provided sources do not state active exploitation. Public references point to academic disclosure context.
Researcher notes
The affected surface is specification behavior rather than a named product list. The key research question is whether a given implementation exposes distinguishable scan-response behavior despite RPA. Avoid assuming all BLE devices are affected without vendor or implementation evidence.
Mitigation direction
- Check Bluetooth stack, chipset, OS, and device vendor advisories for CVE-2020-35473 guidance.
- Prioritize firmware or stack updates when vendors identify affected implementations.
- Reduce unnecessary BLE discoverability or scanning exposure where business operations allow.
- Treat BLE identifiers as potentially linkable in privacy-sensitive environments.
- Document vendor responses for devices that cannot be updated.
Validation and detection
- Inventory BLE-enabled assets and record Bluetooth stack, firmware, and specification support levels.
- Map assets using Bluetooth Core 4.0 through 5.2 to vendor advisory status.
- Confirm whether devices use Resolvable Private Addressing or allowlist-based BLE privacy features.
- Review privacy-sensitive deployments where nearby tracking would create business or safety impact.
- Record unavailable vendor evidence as an exposure uncertainty, not as non-affected status.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-294: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2020-35473 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N2.81.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
4.3MediumVector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://dl.acm.org/doi/10.1145/3548606.3559372CVE reference
- https://www.sigsac.org/ccs/CCS2022/proceedings/ccs-proceedings.htmlCVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Authentication Bypass by Capture-replay
Authentication Bypass by Capture-replay represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.