PT-2019-14122 · Google+1 · Android+1

Published 2019-11-14 · Updated 2019-11-27 · CVE-2019-15393

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Asus ZenFone Live Android device with a build fingerprint of asus/WW Phone/ASUS X00LD 3:7.1.1/NMF26F/14.0400.1806.203-20180720:user/release-keys

Description The issue allows unauthorized modification of wireless settings via a confused deputy attack. This capability can be accessed by any app co-located on the device, specifically through the pre-installed app with a package name of com.asus.atd.smmitest app.

Recommendations For the Asus ZenFone Live Android device with the specified build fingerprint, consider removing or disabling the com.asus.atd.smmitest app to prevent unauthorized wireless settings modification until a patch is available.

Fix

Weakness Enumeration

CWE-610

Related Identifiers

CVE-2019-15393

Affected Products

Android

Asus Zenfone Live

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2019-15393 · Security Note
• https://kryptowire.com/android-firmware-2019 · Note