CVE-2020-15509

Nordic Semiconductor Android BLE Library through 2.2.1 and DFU Library through 1.10.4 for Android...

6.5 Medium

Nordic Semiconductor Android BLE Library through 2.2.1 and DFU Library through 1.10.4 for Android (as used by nRF Connect and other applications) can engage in unencrypted communication while showing the user that the communication is purportedly encrypted. The problem is in bond creation (e.g., internalCreateBond in BleManagerHandler).

Attack profile

How easy it is to exploit

Attack vector: Adjacent network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

0.54%Down 0.3 points since Apr 14, 2021

What each source reports

NVD Score used 6.5

Record: CVE-2020-15509
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0: 3.3 LowAV:A/AC:L/Au:N/C:P/I:N/A:N
Weakness: CWE-319
Updated: 2026-11-02

CVE List No score

Record: CVE-2020-15509
Updated: 2026-11-02

EUVDEUVD-2020-7501 No score

Record: EUVD-2020-7501
Updated: 2026-11-03

GitHub AdvisoriesGHSA-4jg3-fc9f-gv94 6.5

Nordic Semiconductor Android BLE Library through 2.2.1 and DFU Library through 1.10.4 for Android...

Record: GHSA-4jg3-fc9f-gv94
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-311, CWE-319
Updated: 2026-11-02

OSV 6.5

Record: CVE-2020-15509
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

Affected products

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-15509 is a medium vulnerability (CVSS 6.5) in Nordicsemi Android Ble Library, published July 7, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.54%, the 45th percentile. No source names a fixed version.