PT-2014-7296 · Microsoft · Asha Os

Published 2014-09-22 · Updated 2017-09-08 · CVE-2014-6602

Positive Technologies (AI Summary)

CVSS v2.0

6.6

Medium

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Asha OS version 14.0.4

Description The issue allows physically proximate attackers to bypass the lock-screen protection mechanism. This can lead to unauthorized access, where attackers can read or modify contact information or dial arbitrary telephone numbers. The bypass is achieved by tapping the SOS Option and then tapping the Green Call Option.

Recommendations For Microsoft Asha OS version 14.0.4, as a temporary workaround, consider disabling the SOS Option or restricting access to the lock screen to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2014-6602

Affected Products

Asha Os

References · 3

• 🔥 http://packetstormsecurity.com/files/128320/Nokia-Asha-501-Lock-Bypass.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-6602 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/96195 · Note