Lucene search

[email protected]CVE-2021-41849

HistoryMar 11, 2022 - 11:15 p.m.

CVE-2021-41849

2022-03-1123:15:00

CWE-200

CWE-319

[email protected]

web.nvd.nist.gov

cve-2021-41849

luna simo

ppr1.180610.011

http

pii

china

imei

skyroam

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

5.5 Medium

AI Score

Confidence

High

2.1 Low

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

19.6%

JSON

An issue was discovered in Luna Simo PPR1.180610.011/202001031830. It sends the following Personally Identifiable Information (PII) in plaintext using HTTP to servers located in China: user’s list of installed apps and device International Mobile Equipment Identity (IMEI). This PII is transmitted to log.skyroam.com.cn using HTTP, independent of whether the user uses the Simo software.

CPENameOperatorVersion
bluproducts:g90_firmwarebluproducts g90 firmwareeq-
bluproducts:g9_firmwarebluproducts g9 firmwareeq-
wikomobile:tommy_3_firmwarewikomobile tommy 3 firmwareeq-
wikomobile:tommy_3_plus_firmwarewikomobile tommy 3 plus firmwareeq-
luna:simo_firmwareluna simo firmwareeq-

CPE	Name	Operator	Version
bluproducts:g90_firmware	bluproducts g90 firmware	eq	-
bluproducts:g9_firmware	bluproducts g9 firmware	eq	-
wikomobile:tommy_3_firmware	wikomobile tommy 3 firmware	eq	-
wikomobile:tommy_3_plus_firmware	wikomobile tommy 3 plus firmware	eq	-
luna:simo_firmware	luna simo firmware	eq	-

References

athack.com/session-details/401

simowireless.com/

www.kryptowire.com/android-firmware-2022/

www.kryptowire.com/blog/vsim-vulnerability-within-simo-android-phones-exposed/

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

5.5 Medium

AI Score

Confidence

High

2.1 Low

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

19.6%

JSON

Related for CVE-2021-41849

prion1 cvelist1