{"id":"CVE-2020-12856","aliases":["A-157038281","ASB-A-157038281","EUVD-2020-5138","GHSA-9q2w-3c47-gq6j"],"status":"published","title":"OpenTrace, as used in COVIDSafe through v1.0.17, TraceTogether, ABTraceTogether, and other...","description":"OpenTrace, as used in COVIDSafe through v1.0.17, TraceTogether, ABTraceTogether, and other applications on iOS and Android, allows remote attackers to conduct long-term re-identification attacks and possibly have unspecified other impact, because of how Bluetooth is used.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.05142,"percentile":0.92514,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"published":"2020-05-18T03:35:36Z","modified":"2026-11-05T16:32:28Z","exploits":[{"source":"pocgithub","id":"alwentiu/COVIDSafe-CVE-2020-12856","title":"alwentiu/COVIDSafe-CVE-2020-12856","date":"2020-05-15","url":"https://github.com/alwentiu/COVIDSafe-CVE-2020-12856"}],"fixes":[{"ecosystem":"Android","package":"platform/packages/apps/Bluetooth","fixed_in":["11-next:2020-11-01","8.0:2020-11-01","8.1:2020-11-01","9:2020-11-01","10:2020-11-01","11:2020-11-01"],"sources":["osv"]},{"ecosystem":"Android","package":"platform/system/bt","fixed_in":["11-next:2020-11-01","8.0:2020-11-01","8.1:2020-11-01","9:2020-11-01","10:2020-11-01","11:2020-11-01"],"sources":["osv"]},{"ecosystem":"Android","package":"platform/hardware/libhardware","fixed_in":["8.0:2020-11-01","8.1:2020-11-01"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Android","package":"platform/packages/apps/Bluetooth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11-next:0"},{"fixed":"11-next:2020-11-01"}]}],"versions":["11-next"]},{"source":"osv","ecosystem":"Android","package":"platform/system/bt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11-next:0"},{"fixed":"11-next:2020-11-01"}]}],"versions":["11-next"]},{"source":"osv","ecosystem":"Android","package":"platform/hardware/libhardware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0:0"},{"fixed":"8.0:2020-11-01"}]}],"versions":["8.0"]},{"source":"osv","ecosystem":"Android","package":"platform/packages/apps/Bluetooth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0:0"},{"fixed":"8.0:2020-11-01"}]}],"versions":["8.0"]},{"source":"osv","ecosystem":"Android","package":"platform/system/bt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0:0"},{"fixed":"8.0:2020-11-01"}]}],"versions":["8.0"]},{"source":"osv","ecosystem":"Android","package":"platform/hardware/libhardware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1:0"},{"fixed":"8.1:2020-11-01"}]}],"versions":["8.1"]},{"source":"osv","ecosystem":"Android","package":"platform/packages/apps/Bluetooth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1:0"},{"fixed":"8.1:2020-11-01"}]}],"versions":["8.1"]},{"source":"osv","ecosystem":"Android","package":"platform/system/bt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1:0"},{"fixed":"8.1:2020-11-01"}]}],"versions":["8.1"]},{"source":"osv","ecosystem":"Android","package":"platform/packages/apps/Bluetooth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9:0"},{"fixed":"9:2020-11-01"}]}],"versions":["9"]},{"source":"osv","ecosystem":"Android","package":"platform/system/bt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9:0"},{"fixed":"9:2020-11-01"}]}],"versions":["9"]},{"source":"osv","ecosystem":"Android","package":"platform/packages/apps/Bluetooth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10:0"},{"fixed":"10:2020-11-01"}]}],"versions":["10"]},{"source":"osv","ecosystem":"Android","package":"platform/system/bt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10:0"},{"fixed":"10:2020-11-01"}]}],"versions":["10"]},{"source":"osv","ecosystem":"Android","package":"platform/packages/apps/Bluetooth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11:0"},{"fixed":"11:2020-11-01"}]}],"versions":["11"]},{"source":"osv","ecosystem":"Android","package":"platform/system/bt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11:0"},{"fixed":"11:2020-11-01"}]}],"versions":["11"]}],"products":[{"vendor":"alberta","product":"abtracetogether"},{"vendor":"health","product":"covidsafe"},{"vendor":"tracetogether","product":"tracetogether"}],"references":[{"url":"https://docs.google.com/document/d/1u5a5ersKBH6eG362atALrzuXo3zuZ70qrGomWVEC27U/edit?usp=sharing","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"https://github.com/alwentiu/COVIDSafe-CVE-2020-12856/blob/master/README.md","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"https://covidsafe.watch/issue-register/cve-2020-12856-long-term-tracking-and-possibly-enables-other-bluetooth-based-attack-vectors","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-12856"},{"url":"https://github.com/advisories/GHSA-9q2w-3c47-gq6j"},{"url":"https://source.android.com/security/bulletin/2020-11-01","tags":["advisory"]},{"url":"https://android.googlesource.com/platform/packages/apps/Bluetooth/+/81c1c7d2d1681434413a615eea532e85fee43db0","tags":["fix"]},{"url":"https://android.googlesource.com/platform/system/bt/+/73b4e5c4ba4c0c96a26ec84564cd9653da50a26c","tags":["fix"]},{"url":"https://android.googlesource.com/platform/system/bt/+/b3f12befdc4def7d695b6f1049cd02238eb1e4a8","tags":["fix"]},{"url":"https://android.googlesource.com/platform/system/bt/+/05243b881764136d3ca67b438d2e500d6f134f6a","tags":["fix"]}],"sources":{"cve":[{"id":"CVE-2020-12856","description":"OpenTrace, as used in COVIDSafe through v1.0.17, TraceTogether, ABTraceTogether, and other applications on iOS and Android, allows remote attackers to conduct long-term re-identification attacks and possibly have unspecified other impact, because of how Bluetooth is used.","status":"published","published":"2020-05-18T03:35:36Z","modified":"2024-08-04T12:04:22.959Z","updated_at":"2026-11-02T14:35:52.925152Z"}],"euvd":[{"id":"EUVD-2020-5138","description":"OpenTrace, as used in COVIDSafe through v1.0.17, TraceTogether, ABTraceTogether, and other applications on iOS and Android, allows remote attackers to conduct long-term re-identification attacks and possibly have unspecified other impact, because of how Bluetooth is used.","status":"published","published":"2020-05-18T03:35:36Z","modified":"2024-08-04T12:04:22Z","updated_at":"2026-11-03T03:07:39.298733Z"}],"ghsa":[{"id":"GHSA-9q2w-3c47-gq6j","title":"OpenTrace, as used in COVIDSafe through v1.0.17, TraceTogether, ABTraceTogether, and other...","description":"OpenTrace, as used in COVIDSafe through v1.0.17, TraceTogether, ABTraceTogether, and other applications on iOS and Android, allows remote attackers to conduct long-term re-identification attacks and possibly have unspecified other impact, because of how Bluetooth is used.","status":"published","published":"2022-05-24T17:18:04Z","modified":"2023-01-29T05:02:41Z","updated_at":"2026-11-02T14:45:09.006349Z"}],"nvd":[{"id":"CVE-2020-12856","description":"OpenTrace, as used in COVIDSafe through v1.0.17, TraceTogether, ABTraceTogether, and other applications on iOS and Android, allows remote attackers to conduct long-term re-identification attacks and possibly have unspecified other impact, because of how Bluetooth is used.","status":"published","published":"2020-05-18T04:15:09.91Z","modified":"2026-06-17T02:52:26.17Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:06:00.784809Z"}],"osv":[{"id":"ASB-A-157038281","description":"In smp_decide_association_model of smp_act.cc, there is a possible silent bluetooth pairing due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","status":"published","published":"2020-11-01T00:00:00Z","modified":"2026-11-10T17:02:23.040266809Z","updated_at":"2026-11-10T17:35:04.393608Z"}]}}