CVE-2020-12860

Name of the Vulnerable Software and Affected Versions COVIDSafe versions through v1.0.17

Description The issue allows a remote attacker to access phone name and model information. This is possible because a BLE device can have four roles and COVIDSafe uses all of them, enabling re-identification of a device and potentially the identification of the owner's name.

Recommendations For COVIDSafe versions through v1.0.17, consider restricting the use of BLE functionalities until a patch is available. As a temporary workaround, users may want to limit the app's access to device information to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.