What’s Vulnerable › Vulnerabilities

CVE-2020-6812

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-03-25 · updated 2026-06-17
• Weakness: CWE-200

Description

The first time AirPods are connected to an iPhone, they become named after the user's name by default (e.g. Jane Doe's AirPods.) Websites with camera or microphone permission are able to enumerate device names, disclosing the user's name. To resolve this issue, Firefox added a special case that renames devices containing the substring 'AirPods' to simply 'AirPods'. This vulnerability affects Thunderbird < 68.6, Firefox < 74, Firefox < ESR68.6, and Firefox ESR < 68.6.

Affected products

• Canonical Ubuntu Linux: 16.04, 18.04, 19.10
• Mozilla Firefox: before 74.0 — fixed in 74.0
• Mozilla Firefox ESR: before 68.6.0 — fixed in 68.6.0
• Mozilla Thunderbird: before 68.6.0 — fixed in 68.6.0

How to fix

Upgrade to a fixed version: Mozilla Firefox 74.0; Mozilla Firefox ESR 68.6.0; Mozilla Thunderbird 68.6.0. Check the vendor advisory for mitigations.

References

• https://bugzilla.mozilla.org/show_bug.cgi?id=1616661
• https://usn.ubuntu.com/4328-1/
• https://usn.ubuntu.com/4335-1/
• https://www.mozilla.org/security/advisories/mfsa2020-08/
• https://www.mozilla.org/security/advisories/mfsa2020-09/
• https://www.mozilla.org/security/advisories/mfsa2020-10/
• https://bugzilla.mozilla.org/show_bug.cgi?id=1616661
• https://usn.ubuntu.com/4328-1/
• https://usn.ubuntu.com/4335-1/
• https://www.mozilla.org/security/advisories/mfsa2020-08/
• https://www.mozilla.org/security/advisories/mfsa2020-09/
• https://www.mozilla.org/security/advisories/mfsa2020-10/

Get alerted when CVE-2020-6812 or the next vulnerability affects your stack