PT-2019-14198 · Xiaomi+1 · Xiaomi Mi Pad 4+1

Published 2019-11-14 · Updated 2020-08-24 · CVE-2019-15469

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Xiaomi Mi Pad 4 Android device with a build fingerprint of Xiaomi/clover/clover:8.1.0/OPM1.171019.019/V9.6.26.0.ODJCNFD:user/release-keys com.qualcomm.qti.callenhancement app version 8.1.0

Description The issue allows other pre-installed apps to perform microphone audio recording via an accessible app component. This capability can be accessed by any pre-installed app on the device that can obtain signatureOrSystem permissions. The app enables a third-party app to use its open interface to record telephone calls to external storage.

Recommendations For the Xiaomi Mi Pad 4 Android device, consider restricting access to the microphone for pre-installed apps that do not require this capability. For the com.qualcomm.qti.callenhancement app version 8.1.0, consider disabling the app's interface that allows other apps to record telephone calls until a patch is available.

Fix

Related Identifiers

CVE-2019-15469

Affected Products

Xiaomi Mi Pad 4

Com.Qualcomm.Qti.Callenhancement

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2019-15469 · Security Note
• https://kryptowire.com/android-firmware-2019 · Note