PT-2019-14116 · Archos+1 · Archos Core 101+1

Publicado 2019-11-14 · Atualizado 2020-08-24 · CVE-2019-15387

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Archos Core 101 Android device with a build fingerprint of archos/MTKAC101CR3G ARCHOS/ac101cr3g:7.0/NRD90M/20180611.034442:user/release-keys

Description The issue concerns a pre-installed app with a package name of com.roco.autogen that allows any co-located app to disable and enable Wi-Fi without the necessary access permission. This is possible due to an exported interface.

Recommendations For the Archos Core 101 Android device, consider disabling the com.roco.autogen app to prevent unauthorized access to Wi-Fi settings until a patch is available. Restricting the use of the exported interface in the com.roco.autogen app can also help minimize the risk of exploitation.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2019-15387

Produtos afetados

Android

Archos Core 101

Referências · 2

• https://nvd.nist.gov/vuln/detail/CVE-2019-15387 · Nota de Segurança
• https://kryptowire.com/android-firmware-2019 · Nota