CVE-2020-14292

Name of the Vulnerable Software and Affected Versions COVIDSafe application through 1.0.21 for Android

Description The issue allows attackers to trick the application into establishing a connection over Bluetooth BR/EDR transport, revealing the public Bluetooth address of the victim's phone without authorization, bypassing the Bluetooth address randomisation protection in the user's phone. This is due to the unsafe use of the Bluetooth transport option in the GATT connection.

Recommendations For COVIDSafe application versions through 1.0.21 for Android, consider disabling the Bluetooth functionality until a patch is available to prevent exploitation. Restrict access to the GATT connection to minimize the risk of revealing the public Bluetooth address.