CVE-2020-13702: The Rolling Proximity Identifier Project The Rolling Proximity Identifier

Critical severity, CVSS 10.0. EPSS: 2.2% chance of exploitation in the next 30 days.

The Rolling Proximity Identifier used in the Apple/Google Exposure Notification API beta through 2020-05-29 enables attackers to circumvent Bluetooth Smart Privacy because there is a secondary temporary UID. An attacker with access to Beacon or IoT networks can seamlessly track individual device movement via a Bluetooth LE discovery mechanism.

Affected products

• The Rolling Proximity Identifier Project The Rolling Proximity Identifier: up to and including 2020-05-29

Published 2020-06-11. Last modified 2026-06-17.