CVE-2020-12351
CVE-2020-12351
Vexday Risk Score
23Low
SSVC decision (CISA)
Attend
PoC available → attend closely
Exploit maturity
Proof of concept
Popular PoC on GitHub (2 stars) — exploitation code widely available.
CVSS —EPSS 7.7%KEV nãoPoC públicaNuclei —Metasploit —Patch —
Lifecycle
23 Nov 2020Published on NVD
01 Mar 2021Public PoC
Weaponization speed
98 daysto first PoC
Recommendation: Plan a near-term fix — a public PoC already exists.
Improper input validation in BlueZ may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.
Affected products
n/a · BlueZpublic PoCs found — 3
githubgithub.com/naren-jayram/Linux-Heap-Based-Type-Confusion-in-L2CAP★ 2cve_referencepacketstormsecurity.com/files/162131/Linux-Kernel-5.4-BleedingTooth-Remote-Code-Execution.htmlunverifiedexploitdbwww.exploit-db.com/exploits/49754unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.