Lucene search

MitreCVE-2019-16243

HistoryNov 26, 2019 - 4:15 p.m.

CVE-2019-16243

2019-11-2616:15:12

CWE-306

mitre

web.nvd.nist.gov

tcl

alcatel

cingular flip 2

b9huah1

undocumented web api

javascript

firmware

over-the-air update

nvd

cve-2019-16243

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

6.2

Confidence

High

EPSS

0.001

Percentile

32.7%

JSON

On TCL Alcatel Cingular Flip 2 B9HUAH1 devices, there is an undocumented web API that allows unprivileged JavaScript, including JavaScript running within the KaiOS browser, to view and edit the device’s firmware over-the-air update settings. (This web API is normally used by the system application to trigger firmware updates via OmaService.js.)

Affected configurations

Nvd

Node

alcatelmobilecingular_flip_2_firmwareMatchb9huah1

AND

alcatelmobilecingular_flip_2Match-

VendorProductVersionCPE
alcatelmobilecingular_flip_2_firmwareb9huah1cpe:2.3:o:alcatelmobile:cingular_flip_2_firmware:b9huah1:*:*:*:*:*:*:*
alcatelmobilecingular_flip_2-cpe:2.3:h:alcatelmobile:cingular_flip_2:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
alcatelmobile	cingular_flip_2_firmware	b9huah1	cpe:2.3:o:alcatelmobile:cingular_flip_2_firmware:b9huah1:::::::*
alcatelmobile	cingular_flip_2	-	cpe:2.3:h:alcatelmobile:cingular_flip_2:-:::::::*

References

www.nccgroup.trust/uk/our-research/?research=Technical+advisories

www.nccgroup.trust/us/our-research/technical-advisory-multiple-vulnerabilities-in-alcatel-flip-2/#B

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

6.2

Confidence

High

EPSS

0.001

Percentile

32.7%

JSON

Related for CVE-2019-16243