PT-2017-2428 · Google+1 · Android+1

Publicado 2017-06-30 · Atualizado 2019-10-03 · CVE-2017-10709

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Elephone P9000 devices running Android 6.0

Description The issue concerns a security flaw in the lockscreen component of the Android operating system, specifically related to errors in security settings. This flaw allows a physically proximate attacker to bypass the wrong-PIN lockout feature. The attacker can exploit this by pressing the backspace key after each PIN guess, thereby circumventing the lockout mechanism.

Recommendations For Elephone P9000 devices running Android 6.0, consider disabling the lockscreen feature until a patch is available, or avoid using the PIN lock feature to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Enumeração de Fraquezas

CWE-287

CWE-254

Identificadores relacionados

BDU:2017-01633

CVE-2017-10709

Produtos afetados

Android

Elephone P9000

Referências · 9

• https://bdu.fstec.ru/vul/2017-01633 · Nota de Segurança
• https://trustwave.com/Resources/Security-Advisories/Advisories/TWSL2017-011/?fid=9707 · Nota
• https://reddit.com/r/netsec/comments/6kajkc/elephone_p9000_lock_screen_lockout_bypass_with · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-10709 · Nota de Segurança
• https://trustwave.com/Resources/SpiderLabs-Blog/Elephone-P9000-Lock-Screen-Lockout-Bypass/?page=1&year=0&month=0 · Nota
• https://osv.dev/vulnerability/CVE-2017-10709 · Aviso do Fabricante
• https://trustwave.com/Resources/SpiderLabs-Blog/Elephone-P9000-Lock-Screen-Lockout-Bypass/?page=1&year=0&month=0 · Nota
• https://security.nl/posting/522081/Schermvergrendeling+Elephone+P9000+door+lek+te+omzeilen · Nota
• https://youtube.com/watch?v=dwyzonP2eZw · Nota