CVE-2020-26557: Bluetooth Mesh Profile

High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days.

Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device (without possession of the AuthValue used in the provisioning protocol) to determine the AuthValue via a brute-force attack (unless the AuthValue is sufficiently random and changed each time).

Affected products

• Bluetooth Mesh Profile: version 1.0.0 only; version 1.0.1 only

Published 2021-05-24. Last modified 2026-06-17.