PT-2021-9033 · Tk Star · Setracker2

Dennis Van Warmerdam + 2 · Published 2021-02-01 · Updated 2024-07-30 · CVE-2019-20468

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SeTracker2 for TK-Star Q90 Junior GPS horloge version 3.1042.9.8656

Description An issue was discovered in the software, where it has unnecessary permissions such as READ EXTERNAL STORAGE, WRITE EXTERNAL STORAGE, and READ CONTACTS.

Recommendations For version 3.1042.9.8656, consider restricting the use of unnecessary permissions to minimize potential risks until a patch or update is available.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2019-20468

Affected Products

Setracker2

References · 7

• https://tk-star.com · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-20468 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-20468 · Security Note
• https://t.me/cvenotify/87840 · Telegram Post
• https://t.me/cibsecurity/22928 · Telegram Post
• https://eurofins-cybersecurity.com/news/connected-devices-smart-watches · Note
• http://seclists.org/fulldisclosure/2024/Jul/14 · Note