PT-2024-16375 · Transsion · Infinix

Szymon Chadam · Published 2024-12-04 · Updated 2024-12-04 · CVE-2024-10576

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Critical

Base vector

AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:X/R:I/V:D/RE:X/U:Amber

Name of the Vulnerable Software and Affected Versions Infinix devices (affected versions not specified)

Description The issue concerns a pre-loaded application com.transsion.agingfunction that exposes an unsecured broadcast receiver. An attacker can communicate with the receiver and force the device to perform a factory reset without any Android system permissions. It is supposed that this problem affects all Infinix Mobile devices, as no response was received from the vendor after multiple attempts to contact them.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-925

Related Identifiers

CVE-2024-10576

Affected Products

Infinix

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-10576 · Security Note
• https://cert.pl/en/posts/2024/12/CVE-2024-10576 · Note
• https://twitter.com/CveFindCom/status/1864287112477978897 · Twitter Post
• https://cert.pl/posts/2024/12/CVE-2024-10576 · Note
• https://t.me/cvedetector/11985 · Telegram Post
• https://twitter.com/CVEnew/status/1864294591765336525 · Twitter Post
• https://twitter.com/xvonfers/status/1864298594922106930 · Twitter Post