PT-2019-11159 · Google · Android

Published 2019-09-27 · Updated 2019-10-02 · CVE-2018-9581

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Android version Android-10

Description: The issue concerns local information disclosure in Android's WiFi functionality. Specifically, the RSSI value and SSID information are broadcast as part of android.net.wifi.RSSI CHANGE and android.net.wifi.STATE CHANGE intents. This could lead to local information disclosure without requiring additional execution privileges. User interaction is not necessary for exploitation.

Recommendations: For Android version Android-10, consider restricting access to WiFi intent broadcasts to minimize the risk of information disclosure until a patch is available. As a temporary workaround, limiting the use of android.net.wifi.RSSI CHANGE and android.net.wifi.STATE CHANGE intents can help mitigate the issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2018-9581

Affected Products

Android

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-9581 · Security Note
• https://osv.dev/vulnerability/CVE-2018-9581 · Vendor Advisory
• https://source.android.com/security/bulletin/android-10 · Vendor Advisory