CVE-2020-0022

highpriority · attend · 47EPSS 0.061 · 93 %ileexploit · PoCEUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

9 exploits · PoC

Likely / severe?

6.05% (93rd) EPSS

CVSS 8.3 · high

Is it mine?

26 products

Check your exposure

Who says so?

3 sources

cnnvd · enisa_euvd · nvd

EPSS · scored 2026-10-27

In reassemble_and_dispatch of packet_fragmenter.cc, there is possible out of bounds write due to an incorrect bounds calculation. This could lead to remote code execution over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-143894715

cvss

Technical severity, 0–10. One row per scoring source.

8.8

010

base score 0–10 · higher = more severe · hover a vector to decode

v2.08.3highAV:A/AC:L/Au:N/C:C/I:C/A:Cprimary · NVD / NIST USexploitability 6.5 · impact 10

v3.18.8highCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 2.8 · impact 5.9

v3.18.8highCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.18.8highCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondaryexploitability 2.8 · impact 5.9

v3.18.3highCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Psecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: poc · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-682USprimary

exploits (9)

Public proof-of-concept and weaponised exploit code.

5k1l/cve-2020-0022cve-2020-0022相关的一些东西PoC · poc_in_github
Polo35/CVE-2020-0022CVE-2020-0022 vulnerability exploitation on Bouygues BBox Miami (Android TV 8.0 - ARM32 Cortex A9)PoC · poc_in_github
devdanqtuan/poc-for-cve-2020-0022cve-2020-0022PoC · poc_in_github
idkwim/CVE-2020-0022BlueFrag experimentsPoC · poc_in_github
k3vinlusec/Bluefrag_CVE-2020-0022This is a RCE bluetooth vulnerability on Android 8.0 and 9.0PoC · poc_in_github
kalibb/CVE-2020-0022kalibb/CVE-2020-0022PoC · poc_in_github

affected products (26)

Products and version ranges known to be affected.

n/a Android≤ Android-8.0 Android-8.1 Android-9 Android-10enisa_euvdEU
google android= 10.0nvdUScpe:2.3:o:google:android:*:*:*:*:*:*:*:*
google android= 8.0nvdUScpe:2.3:o:google:android:*:*:*:*:*:*:*:*
google android= 8.1nvdUScpe:2.3:o:google:android:*:*:*:*:*:*:*:*
google android= 9.0nvdUScpe:2.3:o:google:android:*:*:*:*:*:*:*:*
huawei honor 8a firmware< 9.1.0.291\(c185e3r4p1\)nvdUScpe:2.3:o:huawei:honor_8a_firmware:*:*:*:*:*:*:*:*
huawei honor 8x firmware< 10.0.0.183\(c185e2r6p1\)nvdUScpe:2.3:o:huawei:honor_8x_firmware:*:*:*:*:*:*:*:*
huawei honor view 20 firmware< 10.0.0.195\(c636e3r4p3\)nvdUScpe:2.3:o:huawei:honor_view_20_firmware:*:*:*:*:*:*:*:*
huawei mate 20 firmware< 10.0.0.195\(c00e74r3p8\)nvdUScpe:2.3:o:huawei:mate_20_firmware:*:*:*:*:*:*:*:*
huawei mate 20 pro firmware< 10.0.0.196\(c185e7r2p4\)nvdUScpe:2.3:o:huawei:mate_20_pro_firmware:*:*:*:*:*:*:*:*
huawei mate 20 x firmware< 10.0.0.195\(c00e74r2p8\)nvdUScpe:2.3:o:huawei:mate_20_x_firmware:*:*:*:*:*:*:*:*
huawei mate 30 5g firmware< 10.0.0.203\(c00e202r7p2\)nvdUScpe:2.3:o:huawei:mate_30_5g_firmware:*:*:*:*:*:*:*:*
huawei mate 30 firmware< 10.0.0.203\(c00e202r7p2\)nvdUScpe:2.3:o:huawei:mate_30_firmware:*:*:*:*:*:*:*:*
huawei mate 30 pro 5g firmware< 10.0.0.203\(c00e202r7p2\)nvdUScpe:2.3:o:huawei:mate_30_pro_5g_firmware:*:*:*:*:*:*:*:*
huawei mate 30 pro firmware< 10.0.0.203\(c00e202r7p2\)nvdUScpe:2.3:o:huawei:mate_30_pro_firmware:*:*:*:*:*:*:*:*
huawei nova 3 firmware< 9.1.0.338\(c00e333r1p1t8\)nvdUScpe:2.3:o:huawei:nova_3_firmware:*:*:*:*:*:*:*:*
huawei nova lite 3 firmware< 9.1.0.322\(c635e8r2p2\)nvdUScpe:2.3:o:huawei:nova_lite_3_firmware:*:*:*:*:*:*:*:*
huawei p smart 2019 firmware< 10.0.0.180\(c185e3r4p1\)nvdUScpe:2.3:o:huawei:p_smart_2019_firmware:*:*:*:*:*:*:*:*
huawei p smart firmware< 9.1.0.193\(c605e6r1p5t8\)nvdUScpe:2.3:o:huawei:p_smart_firmware:*:*:*:*:*:*:*:*
huawei p20 firmware< 10.0.0.162\(c00e156r1p4\)nvdUScpe:2.3:o:huawei:p20_firmware:*:*:*:*:*:*:*:*

showing 20 of 26

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd nvd NVD CVE.org MITRE

published 2020-02-13modified 2026-06-17

related (254)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2022-30780US	high7.5	57.2% (99th)	Exploit	2022-06-11
Lighttpd 1.4.56 through 1.4.58 allows a remote attacker to cause a denial of service (CPU consumption from stuck connections) because connection_read_header_more in connections.c h…
CVE-2016-0777US	medium6.5	63.5% (99th)	Exploit	2016-01-14
The resend_bytes function in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2 allows remote servers to obtain sensitive information from process memory by r…
CVE-2017-7376US	critical9.8	23.2% (98th)	Exploit	2018-02-19
Buffer overflow in libxml2 allows remote attackers to execute arbitrary code by leveraging an incorrect limit for port values when handling redirects.
CVE-2022-30600US	critical9.8	4.97% (92nd)	Exploit	2022-05-18
A flaw was found in moodle where logic used to count failed login attempts could result in the account lockout threshold being bypassed.
CVE-2021-45960US	high8.8	4.67% (92nd)	Exploit	2022-01-01
In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, o…

+249 more

references (16)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan