Lucene search

MitreCVE-2019-15418

HistoryNov 14, 2019 - 5:15 p.m.

CVE-2019-15418

2019-11-1417:15:21

CWE-610

mitre

web.nvd.nist.gov

asus

android device

build fingerprint

app

package name

versioncode

versionname

unauthorized command execution

confused deputy attack

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.4

Confidence

High

EPSS

Percentile

12.6%

JSON

The Asus ASUS_X00K_1 Android device with a build fingerprint of asus/CN_X00K/ASUS_X00K_1:7.0/NRD90M/CN_X00K-14.01.1711.27-20180420:user/release-keys contains a pre-installed app with a package name of com.lovelyfont.defcontainer app (versionCode=5, versionName=5.0.1) that allows unauthorized command execution via a confused deputy attack. This capability can be accessed by any app co-located on the device.

Affected configurations

Nvd

Node

asuspegasus_4a_firmwareMatch-

AND

asuspegasus_4aMatch-

Node

asuspegasus_4_max_firmwareMatch-

AND

asuspegasus_4_maxMatch-

VendorProductVersionCPE
asuspegasus_4a_firmware-cpe:2.3:o:asus:pegasus_4a_firmware:-:*:*:*:*:*:*:*
asuspegasus_4a-cpe:2.3:h:asus:pegasus_4a:-:*:*:*:*:*:*:*
asuspegasus_4_max_firmware-cpe:2.3:o:asus:pegasus_4_max_firmware:-:*:*:*:*:*:*:*
asuspegasus_4_max-cpe:2.3:h:asus:pegasus_4_max:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
asus	pegasus_4a_firmware	-	cpe:2.3:o:asus:pegasus_4a_firmware:-:::::::*
asus	pegasus_4a	-	cpe:2.3:h:asus:pegasus_4a:-:::::::*
asus	pegasus_4_max_firmware	-	cpe:2.3:o:asus:pegasus_4_max_firmware:-:::::::*
asus	pegasus_4_max	-	cpe:2.3:h:asus:pegasus_4_max:-:::::::*

References

www.kryptowire.com/android-firmware-2019/

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.4

Confidence

High

EPSS

Percentile

12.6%

JSON

Related for CVE-2019-15418