PT-2016-4837 · Lenovo · Shareit

Ivan Huertas · Published 2016-01-26 · Updated 2018-10-09 · CVE-2016-1491

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Lenovo SHAREit versions prior to 3.2.0

Description The issue concerns a hardcoded password in the Wifi hotspot feature of Lenovo SHAREit. When configured to receive files, the hardcoded password 12345678 can be exploited by remote attackers within the WLAN coverage area to gain access.

Recommendations For versions prior to 3.2.0, update to version 3.2.0 or later to resolve the issue. As a temporary workaround, consider disabling the Wifi hotspot feature when not in use to minimize the risk of exploitation. Restrict access to the device's WLAN to trusted users only.

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2016-1491

Affected Products

Shareit

References · 7

• https://support.lenovo.com/us/en/product_security/len_4058 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-1491 · Security Note
• https://osv.dev/vulnerability/CVE-2016-1491 · Vendor Advisory
• http://packetstormsecurity.com/files/135378/Lenovo-ShareIT-Information-Disclosure-Hardcoded-Password.html · Note
• http://securityfocus.com/archive/1/537365/100/0/threaded · Note
• http://coresecurity.com/advisories/lenovo-shareit-multiple-vulnerabilities · Note
• http://seclists.org/fulldisclosure/2016/Jan/67 · Note