PT-2019-9084 · Essentia · Essential Phone

Publicado 2019-04-25 · Atualizado 2019-05-02 · CVE-2018-14994

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions Essential Phone Android device with a build fingerprint of essential/mata/mata:8.1.0/OPM1.180104.166/297:user/release-keys

Description The device contains a pre-installed platform app with a package name of com.ts.android.hiddenmenu that has an exported activity app component named com.ts.android.hiddenmenu.rtn.RTNResetActivity. This component allows any app on the device to initiate a factory reset programmatically without requiring any permissions. A factory reset will remove all user data and apps from the device, resulting in the loss of any data that have not been backed up or synced externally.

Recommendations For the Essential Phone Android device with a build fingerprint of essential/mata/mata:8.1.0/OPM1.180104.166/297:user/release-keys, consider disabling the com.ts.android.hiddenmenu.rtn.RTNResetActivity component to prevent unauthorized factory resets until a patch is available. Restrict access to the com.ts.android.hiddenmenu app to minimize the risk of exploitation. Avoid using apps that may leverage the vulnerable component to initiate a factory reset.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2018-14994

Produtos afetados

Essential Phone

Referências · 4

• 🔥 https://kryptowire.com/portal/android-firmware-defcon-2018 · Exploit
• https://kryptowire.com · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-14994 · Nota de Segurança
• https://kryptowire.com/portal/wp-content/uploads/2018/12/DEFCON-26-Johnson-and-Stavrou-Vulnerable-Out-of-the-Box-An-Eval-of-Android-Carrier-Devices-WP-Updated.pdf · Nota