Path traversal

2020-01-2214:15:00

PRIOn knowledge base

www.prio-n.com

0.001 Low

EPSS

Percentile

39.9%

JSON

Samsung Galaxy Gear series before build RE2 includes the hcidump utility with no privilege or permission restriction. This allows an unprivileged process to dump Bluetooth HCI packets to an arbitrary file path.

CPENameOperatorVersion
galaxy_gear_firmwareeq< re2
gear_2_firmwareeq< re2
gear_fit_2_firmwareeq< re2
gear_fit_2_pro_firmwareeq< re2
gear_fit_firmwareeq< re2
gear_live_firmwareeq< re2
gear_s2_firmwareeq< re2
gear_s3_firmwareeq< re2
gear_s_firmwareeq< re2
gear_sport_firmwareeq< re2

Name	Operator	Version
galaxy_gear_firmware	eq	< re2
gear_2_firmware	eq	< re2
gear_fit_2_firmware	eq	< re2
gear_fit_2_pro_firmware	eq	< re2
gear_fit_firmware	eq	< re2
gear_live_firmware	eq	< re2
gear_s2_firmware	eq	< re2
gear_s3_firmware	eq	< re2
gear_s_firmware	eq	< re2
gear_sport_firmware	eq	< re2

References

media.defcon.org/DEF%20CON%2026/DEF%20CON%2026%20presentations/Dongsung%20Kim%20and%20Hyoung%20Kee%20Choi%20-%20Updated/DEFCON-26-Dongsung-Kim-and-Hyoung-Kee-Choi-Your-Watch-Can-Watch-You-Updated.pdf

www.youtube.com/watch?v=3IdgBwbOT-g&feature=youtu.be

0.001 Low

EPSS

Percentile

39.9%

JSON

Related for PRION:CVE-2018-16270