CVE-2019-15426

CVE-2019-15426 affects the Xiaomi 5S Plus Android device (build fingerprint Xiaomi/natrium/natrium:6.0.1/MXB48T/7.1.5:user/release-keys). A pre-installed app (package com.miui.powerkeeper, versionCode 40000, versionName 4.0.00) enables unauthorized wireless settings modification via a confused de...

CVE-2019-15426

The Xiaomi 5S Plus Android device with a build fingerprint of Xiaomi/natrium/natrium:6.0.1/MXB48T/7.1.5:user/release-keys contains a pre-installed app with a package name of com.miui.powerkeeper app versionCode=40000, versionName=4.0.00 that allows unauthorized wireless settings modification via ...

CVE-2019-15425

The Kata M4s Android device with a build fingerprint of alps/fullhct675066n/hct675066n:7.0/NRD90M/1495624556:user/test-keys contains a pre-installed app with a package name of com.mediatek.factorymode app versionCode=1, versionName=1 that allows unauthorized wireless settings modification via a...

CVE-2019-15425

Summary (validated data): The Kata M4s Android device (build fingerprint alps/full_hct6750_66_n/hct6750_66_n:7.0/NRD90M/1495624556:user/test-keys**) contains a pre-installed app with package name com.mediatek.factorymode (versionCode=1, versionName=1) that allows unauthorized wireless settings mo...

CVE-2019-15424

The Doogee BL5000 Android device with a build fingerprint of DOOGEE/BL5000/BL5000:7.0/NRD90M/1497072355:user/release-keys contains a pre-installed app with a package name of com.mediatek.factorymode app versionCode=1, versionName=1 that allows unauthorized wireless settings modification via a...

CVE-2019-15423

CVE-2019-15423 affects the Bluboo Bluboo_S1 on Android 7.0 where a pre-installed app (package com.mediatek.factorymode) allows unauthorized wireless settings modification via a confused deputy attack. The vulnerability is exploitable by any co-located app with local access, enabling partial integ...

CVE-2019-15423

The Bluboo BlubooS1 Android device with a build fingerprint of BLUBOO/BlubooS1/BlubooS1:7.0/NRD90M/1495809471:user/release-keys contains a pre-installed app with a package name of com.mediatek.factorymode app versionCode=1, versionName=1 that allows unauthorized wireless settings modification via...

CVE-2019-15422

The CVE concerns the Doogee Mix Android device (DOOGEE/MIX/MIX:7.0/NRD90M/1495809471:user/release-keys) which ships a pre-installed app with package name com.mediatek.factorymode (versionCode=1, versionName=1). The vulnerability allows unauthorized wireless settings modification via a confused de...

CVE-2019-15422

The Doogee Mix Android device with a build fingerprint of DOOGEE/MIX/MIX:7.0/NRD90M/1495809471:user/release-keys contains a pre-installed app with a package name of com.mediatek.factorymode app versionCode=1, versionName=1 that allows unauthorized wireless settings modification via a confused...

CVE-2019-15421

CVE-2019-15421 affects the Blackview BV7000_Pro device (build Blackview/BV7000_Pro/BV7000_Pro:7.0/NRD90M/1493011204) due to a pre-installed, co-located app named com.mediatek.factorymode (versionCode=1, versionName=1). The vulnerability allows unauthorized wireless settings modification via a con...

CVE-2019-15421

The Blackview BV7000Pro Android device with a build fingerprint of Blackview/BV7000Pro/BV7000Pro:7.0/NRD90M/1493011204:user/release-keys contains a pre-installed app with a package name of com.mediatek.factorymode app versionCode=1, versionName=1 that allows unauthorized wireless settings...

CVE-2019-15419

The Asus ASUSX0151 Android device with a build fingerprint of asus/CNX015/ASUSX0151:7.0/NRD90M/CNX015-14.00.1709.35-20171215:user/release-keys contains a pre-installed app with a package name of com.lovelyfont.defcontainer app versionCode=5, versionName=5.0.1 that allows unauthorized command...

CVE-2019-15419

Technical details about CVE-2019-15419 are not publicly provided in the connected documents. Monitor for updates and new disclosures before drawing conclusions on impact, affected components, or remediation.

CVE-2019-15418

The Asus ASUSX00K1 Android device with a build fingerprint of asus/CNX00K/ASUSX00K1:7.0/NRD90M/CNX00K-14.01.1711.27-20180420:user/release-keys contains a pre-installed app with a package name of com.lovelyfont.defcontainer app versionCode=5, versionName=5.0.1 that allows unauthorized command...

CVE-2019-15417

The CVE-2019-15417 entry concerns a Tecno Spark Pro Android device (build TECNO/H3722/TECNO-K8:7.0/NRD90M/K8-H3722ABCDE-N-171229V96:user/release-keys) with a pre-installed app, com.lovelyfont.defcontainer (versionCode 7, versionName 7.0.5), that allows unauthorized dynamic code loading via a conf...

CVE-2019-15417

The Tecno Spark Pro Android device with a build fingerprint of TECNO/H3722/TECNO-K8:7.0/NRD90M/K8-H3722ABCDE-N-171229V96:user/release-keys contains a pre-installed app with a package name of com.lovelyfont.defcontainer app versionCode=7, versionName=7.0.5 that allows unauthorized dynamic code...

CVE-2019-15415

CVE-2019-15415 concerns a pre-installed app on the Xiaomi Redmi 5 Android device (package com.huaqin.factory) that enables unauthorized modification of wireless settings through a confused-deputy attack. Impact is described as access by any co-located app with low CVSS but partial integrity impac...

CVE-2019-15414

CVE-2019-15414 affects the Asus ZenFone AR; a pre-installed app (com.asus.splendidcommandagent, v1.2.0.21_180605) exposes an accessible component that allows other pre-installed apps to perform command execution. This requires signatureOrSystem permissions granted to the interacting apps, enablin...

CVE-2019-15413

The Asus ZenFone 3 Ultra Android device with a build fingerprint of asus/WWPhone/ASUSA001:7.0/NRD90M/14.1010.1804.75-20180612:user/release-keys contains a pre-installed app with a package name of com.asus.splendidcommandagent app versionCode=1510200105, versionName=1.2.0.21180605 that allows othe...

CVE-2019-15413

The CVE-2019-15413 entry describes a vulnerability on the Asus ZenFone 3 Ultra running Android 7.0 (NRD90M) where a pre-installed component, com.asus.splendidcommandagent (versionCode 1510200105, versionName 1.2.0.21_180605), allows other pre-installed apps to execute commands via an accessible c...