CVE-2020-26558: n/a — Improper Authentication

Ubuntu release	Source package	Vendor state	Fixed version	Evidence
Ubuntu 24.04 LTSnoble · standard archive	`linux-raspi-realtime`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical record ↗Source updated 9 Sept 2026

Recommended actionScheduled

Medium technical severity with no CISA KEV confirmation; remediate through the normal risk-based patch cycle unless local exposure raises the priority.

Patch available

What, why and how

Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 through 5.2 may permit a nearby man-in-the-middle attacker to identify the Passkey used during pairing (in the Passkey authentication procedure) by reflection of the public key and the authentication evidence of the initiating device, potentially permitting this attacker to complete authenticated pairing with the responding device using the correct Passkey for the pairing session. The attack methodology determines the Passkey value one bit at a time.

What

Why

The affected component does not establish the requesting party's identity reliably before granting access.

How

An attacker operating through the affected interface may attempt exploitation without authentication or user interaction. If successful, the issue may cause the confidentiality, integrity or availability impact described by the vendor.

What

Why

The affected component does not establish the requesting party's identity reliably before granting access.

How

Exploit reality and attack path

CVSS severity, EPSS forecast probability, public exploit material and CISA-confirmed exploitation are separate signals.

Observed exploitation

Confirmed exploitation and public exploit material are separate signals. Attacks can occur without public proof-of-concept or exploit code.

No confirmed evidence

No CISA KEV match was present at the last successful refresh. This means no confirmation from that source, not proof of no exploitation.

Public PoC / exploit material

Confirmed exploitation and public exploit material are separate signals. Attacks can occur without public proof-of-concept or exploit code.

None recorded

No exploit-tagged reference or CISA SSVC proof-of-concept state is currently recorded. Research may still exist outside the structured feeds.

Likely attack path: the affected interface → Improper Authentication → cause the confidentiality, integrity or availability impact described by the vendor
Attack surface: Unspecified
Privileges required: None: unauthenticated exploitation is possible
User interaction: None
Attack complexity: High: exploitation depends on specific conditions
Security boundary: Unchanged: impact remains within the vulnerable component's security authority
Weakness ? CWE means Common Weakness Enumeration: a standard category for the underlying weakness.: CWE-287 ↗
CWE-287: Improper Authentication. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CVSS vector ? CVSS means Common Vulnerability Scoring System. The vector records the metric values used to calculate technical severity.: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Common Vulnerability Scoring System 3.1: the compact vector below is decoded into plain language.
AVAdjacentAttack vector: The attacker must be on an adjacent or logically close network.ACHighAttack complexity: Successful exploitation depends on specific conditions outside the attacker's direct control.PRNonePrivileges required: The attacker does not need an account or existing privileges.UINoneUser interaction: No action by another user is required.SUnchangedScope: The security impact remains within the vulnerable component's authority.CLowConfidentiality impact: A successful attack can cause a limited loss.ILowIntegrity impact: A successful attack can cause a limited loss.ANoneAvailability impact: No direct loss is represented by this metric.
Post-exploitation / living off the land: No specific living-off-the-land technique is confirmed in the structured sources. Monitor normal administration tools for activity inconsistent with the affected service's baseline.

UnauthenticatedCWE-287

Official authority intelligence

Only matched European and national findings are included. Language selectors and unavailable sources are omitted.

ENISA EUVD · EUVD-2020-19103Official EUVD mapping

0 linked advisory records.

Official EUVD record

BSI · German · WID-SEC-W-2022-1813Bluetooth: Mehrere Schwachstellen

Ein lokaler Angreifer kann mehrere Schwachstellen im Bluetooth Standard ausnutzen, um Dateien zu manipulieren oder Informationen offenzulegen.

n/a — Improper Authentication

National CERT insights ?CERT means Computer Emergency Response Team; CSIRT is the closely related term Computer Security Incident Response Team.

EUVD-2020-19103

What, why and how

Exploit reality and attack path

Official authority intelligence

Patch and workaround

Evidence and provenance

National CERT insights
?
CERT means Computer Emergency Response Team; CSIRT is the closely related term Computer Security Incident Response Team.