CVE-2020-0471
CRITICALGoogle Android - Improper Input Validation
Title source: ruleDescription
In reassemble_and_dispatch of packet_fragmenter.cc, there is a possible way to inject packets into an encrypted Bluetooth connection due to improper input validation. This could lead to remote escalation of privilege between two Bluetooth devices by a proximal attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-8.0, Android-8.1, Android-9, Android-10, Android-11; Android ID: A-169327567.
Exploits (1)
nomisec
WORKING POC
by nanopathi · poc
https://github.com/nanopathi/system_bt_AOSP10_r33_CVE-2020-0471
Scores
CVSS v3
9.8
EPSS
0.0245
EPSS Percentile
85.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-20
Status
published
Products (5)
google/android
8.0
google/android
8.1
google/android
9.0
google/android
10.0
google/android
11.0
Published
Jan 11, 2021
Tracked Since
Feb 18, 2026