CVE-2016-6564

🗓️ 13 Jul 2018 20:00:00Reported by certccType

cve🔗 web.nvd.nist.gov👁 56 Views🌐 WEB

Android devices with Ragentek code contain a privileged binary for OTA update checks. The binary runs with root privileges and communicates with unencrypted HTTP, making it vulnerable to execution of arbitrary commands as root, application installs, and configuration updates

Reporter	Title	Published	Views	Family All 6
Cvelist	CVE-2016-6564 Ragentek Android software contains an over-the-air update mechanism that communicates over an unencrypted channel, which can allow a remote attacker to execute arbitrary code with root privileges	13 Jul 201820:00	–	cvelist
EUVD	EUVD-2016-7485	7 Oct 202500:30	–	euvd
NVD	CVE-2016-6564	13 Jul 201820:29	–	nvd
Prion	Design/Logic Flaw	13 Jul 201820:29	–	prion
The Hacker News	Dangerous Rootkit found Pre-Installed on nearly 3 Million Android Phones	19 Nov 201600:05	–	thn
CERT	Ragentek Android OTA update mechanism vulnerable to MITM attack	17 Nov 201600:00	–	cert

NVD

Node

infinixauthority hot_x507_firmwareMatch-

AND

infinixauthority hot_x507Match-

Node

infinixauthority hot_2_x510_firmwareMatch-

AND

infinixauthority hot_2_x510Match-

Node

infinixauthority zero_x506_firmwareMatch-

AND

infinixauthority zero_x506Match-

Node

infinixauthority zero_2_x509_firmwareMatch-

AND

infinixauthority zero_2_x509Match-

Node

bluproducts studio_g_firmwareMatch-

AND

bluproducts studio_gMatch-

Node

bluproducts studio_g_plus_firmwareMatch-

AND

bluproducts studio_g_plusMatch-

Node

bluproducts studio_6.0_hd_firmwareMatch-

AND

bluproducts studio_6.0_hdMatch-

Node

bluproducts studio_x_firmwareMatch-

AND

bluproducts studio_xMatch-

Node

bluproducts studio_x_plus_firmwareMatch-

AND

bluproducts studio_x_plusMatch-

Node

bluproducts studio_c_hd_firmwareMatch-

AND

bluproducts studio_c_hdMatch-

Node

xolo cube_5.0_firmwareMatch-

AND

xolo cube_5.0Match-

Node

beeline pro_2_firmwareMatch-

AND

beeline pro_2Match-

Node

iku-mobile colorful_k45i_firmwareMatch-

AND

iku-mobile colorful_k45iMatch-

Node

leagoo lead_5_firmwareMatch-

AND

leagoo lead_5Match-

Node

leagoo lead_6_firmwareMatch-

AND

leagoo lead_6Match-

Node

leagoo lead_3i_firmwareMatch-

AND

leagoo lead_3iMatch-

Node

leagoo lead_2s_firmwareMatch-

AND

leagoo lead_2sMatch-

Node

leagoo alfa_6_firmwareMatch-

AND

leagoo alfa_6Match-

Node

doogee voyager_2_dg310i_firmwareMatch-

AND

doogee voyager_2_dg310iMatch-

[
  {
    "product": "Android software",
    "vendor": "Ragentek",
    "versions": [
      {
        "status": "unknown",
        "version": "N/A"
      }
    ]
  }
]

Source	Link
kb	www.kb.cert.org/vuls/id/624539
securityfocus	www.securityfocus.com/bid/94393/
bitsighttech	www.bitsighttech.com/blog/ragentek-android-ota-update-mechanism-vulnerable-to-mitm-attack

Parameter	Position	Path	Description	CWE
data	query param	/pagt/agent	Unencrypted OTA command channel using POST with data parameter enabling remote execution on rooted devices.	CWE-264, CWE-494

21 Nov 2024 02:56Current

8.3High risk

Vulners AI Score8.3

CVSS 38.1

CVSS 29.3

EPSS0.00341