Design/Logic Flaw

2023-12-0503:15:00

PRIOn knowledge base

www.prio-n.com

insecure protocol

sogousdk

android 11

android 12

android 13

keystroke data

man-in-the-middle attack

7.1 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

20.9%

JSON

Improper usage of insecure protocol (i.e. HTTP) in SogouSDK of Chinese Samsung Keyboard prior to versions 5.3.70.1 in Android 11, 5.4.60.49, 5.4.85.5, 5.5.00.58 in Android 12, and 5.6.00.52, 5.6.10.42, 5.7.00.45 in Android 13 allows adjacent attackers to access keystroke data using Man-in-the-Middle attack.

CPENameOperatorVersion
samsung_keyboardlt5.3.70.1
samsung_keyboardge5.4.60.0
samsung_keyboardlt5.4.60.49
samsung_keyboardge5.4.85.0
samsung_keyboardlt5.4.85.5
samsung_keyboardge5.5.00.0
samsung_keyboardlt5.5.00.58
samsung_keyboardlt5.3.70.1
samsung_keyboardge5.6.00.0
samsung_keyboardlt5.6.00.52

Name	Operator	Version
samsung_keyboard	lt	5.3.70.1
samsung_keyboard	ge	5.4.60.0
samsung_keyboard	lt	5.4.60.49
samsung_keyboard	ge	5.4.85.0
samsung_keyboard	lt	5.4.85.5
samsung_keyboard	ge	5.5.00.0
samsung_keyboard	lt	5.5.00.58
samsung_keyboard	lt	5.3.70.1
samsung_keyboard	ge	5.6.00.0
samsung_keyboard	lt	5.6.00.52