PT-2019-12249 · Samsung · Samsung
Fs0C131Y
·
Publicado
2019-10-09
·
Atualizado
2019-11-05
·
CVE-2019-11341
CVSS v3.1
4.6
Média
| Vetor | AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Samsung P version 9.0
Description
The issue allows an attacker with physical access to start a TCP Dump capture without the user's knowledge by exploiting a feature in the Service Mode application. This application is accessible after entering the *#9900# check code and is protected by a locally created OTP password. However, due to poor cryptography handling, the password can be easily obtained by reversing the password creation logic.
Recommendations
For Samsung P version 9.0, as a temporary workaround, consider restricting access to the Service Mode application until a proper fix is available. Additionally, users should be cautious when allowing physical access to their devices to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Use of a Broken Cryptographic Algorithm
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Samsung