PT-2018-12861 · Google+1 · Android+1

Publicado 2018-12-28 · Atualizado 2019-10-03 · CVE-2018-14985

Positive Technologies (AI Summary)

CVSS v3.1

7.1

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Leagoo Z5C Android device with a build fingerprint of sp7731c 1h10 32v4 bird:6.0/MRA58K/android.20170629.214736:user/release-keys

Description The device contains a pre-installed platform app with a package name of com.android.settings that has an exported broadcast receiver. This allows any app on the device to initiate a factory reset programmatically without requiring any permissions. A factory reset will remove all user data and apps, resulting in data loss if not backed up or synced externally.

Recommendations For the Leagoo Z5C Android device, consider disabling the com.android.settings app or restricting its functionality to prevent unauthorized factory resets until a patch is available.

Exploit

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2018-14985

Produtos afetados

Android

Leagoo Z5C

Referências · 4

• 🔥 https://kryptowire.com/portal/wp-content/uploads/2018/12/DEFCON-26-Johnson-and-Stavrou-Vulnerable-Out-of-the-Box-An-Eval-of-Android-Carrier-Devices-WP-Updated.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-14985 · Nota de Segurança
• https://kryptowire.com/portal/android-firmware-defcon-2018 · Nota
• https://osv.dev/vulnerability/CVE-2018-14985 · Aviso do Fabricante