PT-2012-6154 · Samsung · Samsung Kies Air

Published 2012-12-03 · Updated 2017-08-29 · CVE-2012-5858

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Samsung Kies Air versions 2.1.207051 through 2.1.210161

Description The issue allows remote man-in-the-middle attackers to read arbitrary phone contents by spoofing or controlling the IP address, as the software relies on the IP address for authentication.

Recommendations For Samsung Kies Air versions 2.1.207051 through 2.1.210161, consider implementing additional authentication mechanisms to prevent IP address spoofing attacks, such as using secure tokens or credentials. As a temporary workaround, restrict access to the network to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2012-5858

Affected Products

Samsung Kies Air

References · 6

• 🔥 https://exploit-db.com/exploits/24455 · Exploit
• 🔥 http://securityfocus.com/bid/56560 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-5858 · Security Note
• http://archives.neohapsis.com/archives/bugtraq/2012-11/0061.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/80092 · Note
• http://packetstormsecurity.org/files/118154/Kies-Air-Denial-Of-Service-Authorization-Bypass.html · Note