PatchTheCVECVE-2020-14292: In the COVIDSafe application through 1.0.21 for Android, unsafe use of the Bluetooth transport option in the G
CVE-2020-14292 is a medium-severity flaw (CVSS 5.7) affecting covidsafe. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
In the COVIDSafe application through 1.0.21 for Android, unsafe use of the Bluetooth transport option in the GATT connection allows attackers to trick the application into establishing a connection over Bluetooth BR/EDR transport, which reveals the public Bluetooth address of the victim's phone without authorisation, bypassing the Bluetooth address randomisation protection in the user's phone.
Why this priority
- Public exploit reference
A fixed release or distro patch exists.
Risk facts
| CVSS score | 5.7 (Medium) |
| Attack vector | Adjacent network |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | Required |
| EPSS exploit chance | 1.3% (top 29%) |
| CISA exploited list | No |
| Published | 2020-09-09 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2020-14292?
covidsafe: upgrade to newer than 1.0.21. Exact commands for each OS are on this page.
Is CVE-2020-14292 being exploited?
CVE-2020-14292 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2020-14292 affect?
CVE-2020-14292 affects covidsafe. Severity is medium (CVSS 5.7). In the COVIDSafe application through 1.0.21 for Android, unsafe use of the Bluetooth transport option in the GATT connection allows attackers to trick the application into establishing a connection over Bluetooth BR/EDR transport, which rev
How urgent is CVE-2020-14292?
Priority 43/100. Public exploit reference
Software pages
Android vulnerabilities · Bluetooth vulnerabilities
Related CVEs
- CVE-2020-12860 MEDIUM 5.3 UPGRADE MITIGATE COVIDSafe through v1.0.17 allows a remote attacker to access phone name and model information because a BLE de
- CVE-2020-12859 MEDIUM 5.3 UPGRADE Unnecessary fields in the OpenTrace/BlueTrace protocol in COVIDSafe through v1.0.17 allow a remote attacker to
- CVE-2020-12858 HIGH 7.5 UPGRADE Non-reinitialisation of random data in the advertising payload in COVIDSafe v1.0.15 and v1.0.16 allows a remot
- CVE-2020-12857 HIGH 7.5 UPGRADE Caching of GATT characteristic values (TempID) in COVIDSafe v1.0.15 and v1.0.16 allows a remote attacker to lo
- CVE-2020-12856 CRITICAL 9.8 MITIGATE MITIGATE OpenTrace, as used in COVIDSafe through v1.0.17, TraceTogether, ABTraceTogether, and other applications on iOS