PT-2022-11500 · Luna Simo · Luna Simo

Published 2022-03-11 · Updated 2023-08-08 · CVE-2021-41849

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Luna Simo PPR1.180610.011/202001031830

Description An issue was discovered in Luna Simo where it sends Personally Identifiable Information (PII) in plaintext using HTTP to servers located in China. The PII includes the user's list of installed apps and device International Mobile Equipment Identity (IMEI). This information is transmitted to "log.skyroam.com.cn" using HTTP, regardless of whether the user is using the Simo software.

Recommendations For Luna Simo PPR1.180610.011/202001031830, consider restricting access to the log.skyroam.com.cn endpoint until a secure communication method is implemented. As a temporary workaround, avoid using the Simo software until a patch is available that addresses the transmission of PII in plaintext.

Exploit

Fix

Information Disclosure

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-200

CWE-319

Related Identifiers

CVE-2021-41849

Affected Products

Luna Simo

References · 6

• 🔥 https://kryptowire.com/blog/vsim-vulnerability-within-simo-android-phones-exposed · Exploit
• https://simowireless.com · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41849 · Security Note
• https://t.me/cvenotify/28156 · Telegram Post
• https://athack.com/session-details/401 · Note
• https://kryptowire.com/android-firmware-2022 · Note