PT-2019-14111 · Cubot+2 · Cubot Nova+2

Publicado 2019-11-14 · Atualizado 2020-08-24 · CVE-2019-15382

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cubot Nova Android device with a build fingerprint of CUBOT/CUBOT NOVA/CUBOT NOVA:8.1.0/O11019/1527060122:user/release-keys com.mediatek.wfo.impl app version 8.1.0

Description The issue concerns a pre-installed app on the Cubot Nova Android device that allows any co-located app to modify a system property without proper authorization. This is due to an exported interface in the com.mediatek.wfo.impl app.

Recommendations For the Cubot Nova Android device with the specified build fingerprint, consider restricting access to the com.mediatek.wfo.impl app until a patch is available. For the com.mediatek.wfo.impl app version 8.1.0, as a temporary workaround, consider disabling the exported interface that allows modification of system properties.

Correção

Identificadores relacionados

CVE-2019-15382

Produtos afetados

Android

Cubot Nova

Com.Mediatek.Wfo.Impl

Referências · 2

• https://kryptowire.com/android-firmware-2019 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-15382 · Nota de Segurança