Bluetooth Low Energy Vulnerability in Cypress PSoC Creator BLE Component

CVE-2020-11957

What is CVE-2020-11957?

The Bluetooth Low Energy implementation in the Cypress PSoC Creator BLE 4.2 component, specifically in versions prior to 3.64, suffers from a significant insufficiency in random number generation during the pairing process. This deficiency results in a Pairing Random that has far less entropy than the required 128 bits for secure Bluetooth communications. As a consequence, both authenticated and unauthenticated pairing—whether using LE Secure Connections or LE Legacy Pairing—become susceptible to exploitation. An attacker within radio range could leverage this vulnerability to execute a man-in-the-middle (MITM) attack, intercepting and potentially altering communication during the pairing process.

References