PT-2019-14122 · Google+1 · Android+1

Publicado 2019-11-14 · Atualizado 2019-11-27 · CVE-2019-15393

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Asus ZenFone Live Android device with a build fingerprint of asus/WW Phone/ASUS X00LD 3:7.1.1/NMF26F/14.0400.1806.203-20180720:user/release-keys

Description The issue allows unauthorized modification of wireless settings via a confused deputy attack. This capability can be accessed by any app co-located on the device, specifically through the pre-installed app with a package name of com.asus.atd.smmitest app.

Recommendations For the Asus ZenFone Live Android device with the specified build fingerprint, consider removing or disabling the com.asus.atd.smmitest app to prevent unauthorized wireless settings modification until a patch is available.

Correção

Enumeração de Fraquezas

CWE-610

Identificadores relacionados

CVE-2019-15393

Produtos afetados

Android

Asus Zenfone Live

Referências · 2

• https://nvd.nist.gov/vuln/detail/CVE-2019-15393 · Nota de Segurança
• https://kryptowire.com/android-firmware-2019 · Nota