Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device (without possession of the AuthValue used in the provisioning protocol) to determine the AuthValue via a brute-force attack (unless the AuthValue is sufficiently random and changed each time).
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Mesh_profile | Bluetooth | 1.0.0 (including) | 1.0.0 (including) |
| Mesh_profile | Bluetooth | 1.0.1 (including) | 1.0.1 (including) |