CVE-2019-15427

The Xiaomi Mi Mix Android device with a build fingerprint of Xiaomi/lithium/lithium:6.0.1/MXB48T/7.1.5:user/release-keys contains a pre-installed app with a package name of com.miui.powerkeeper app versionCode=40000, versionName=4.0.00 that allows unauthorized wireless settings modification via a...

CVE-2019-15426

CVE-2019-15426 affects the Xiaomi 5S Plus Android device (build fingerprint Xiaomi/natrium/natrium:6.0.1/MXB48T/7.1.5:user/release-keys). A pre-installed app (package com.miui.powerkeeper, versionCode 40000, versionName 4.0.00) enables unauthorized wireless settings modification via a confused de...

CVE-2019-15426

The Xiaomi 5S Plus Android device with a build fingerprint of Xiaomi/natrium/natrium:6.0.1/MXB48T/7.1.5:user/release-keys contains a pre-installed app with a package name of com.miui.powerkeeper app versionCode=40000, versionName=4.0.00 that allows unauthorized wireless settings modification via ...

CVE-2019-15425

The Kata M4s Android device with a build fingerprint of alps/fullhct675066n/hct675066n:7.0/NRD90M/1495624556:user/test-keys contains a pre-installed app with a package name of com.mediatek.factorymode app versionCode=1, versionName=1 that allows unauthorized wireless settings modification via a...

CVE-2019-15425

Summary (validated data): The Kata M4s Android device (build fingerprint alps/full_hct6750_66_n/hct6750_66_n:7.0/NRD90M/1495624556:user/test-keys**) contains a pre-installed app with package name com.mediatek.factorymode (versionCode=1, versionName=1) that allows unauthorized wireless settings mo...

CVE-2019-15424

CVE-2019-15424 affects the Doogee BL5000 Android device (build DOOGEE/BL5000/BL5000:7.0/NRD90M/1497072355:user/release-keys) via a pre-installed com.mediatek.factorymode app. The issue enables unauthorized wireless settings modification through a confused deputy attack, exploitable by any app co-...

CVE-2019-15424

The Doogee BL5000 Android device with a build fingerprint of DOOGEE/BL5000/BL5000:7.0/NRD90M/1497072355:user/release-keys contains a pre-installed app with a package name of com.mediatek.factorymode app versionCode=1, versionName=1 that allows unauthorized wireless settings modification via a...

CVE-2019-15423

CVE-2019-15423 affects the Bluboo Bluboo_S1 on Android 7.0 where a pre-installed app (package com.mediatek.factorymode) allows unauthorized wireless settings modification via a confused deputy attack. The vulnerability is exploitable by any co-located app with local access, enabling partial integ...

CVE-2019-15423

The Bluboo BlubooS1 Android device with a build fingerprint of BLUBOO/BlubooS1/BlubooS1:7.0/NRD90M/1495809471:user/release-keys contains a pre-installed app with a package name of com.mediatek.factorymode app versionCode=1, versionName=1 that allows unauthorized wireless settings modification via...

CVE-2019-15422

The CVE concerns the Doogee Mix Android device (DOOGEE/MIX/MIX:7.0/NRD90M/1495809471:user/release-keys) which ships a pre-installed app with package name com.mediatek.factorymode (versionCode=1, versionName=1). The vulnerability allows unauthorized wireless settings modification via a confused de...

CVE-2019-15422

The Doogee Mix Android device with a build fingerprint of DOOGEE/MIX/MIX:7.0/NRD90M/1495809471:user/release-keys contains a pre-installed app with a package name of com.mediatek.factorymode app versionCode=1, versionName=1 that allows unauthorized wireless settings modification via a confused...

CVE-2019-15421

The Blackview BV7000Pro Android device with a build fingerprint of Blackview/BV7000Pro/BV7000Pro:7.0/NRD90M/1493011204:user/release-keys contains a pre-installed app with a package name of com.mediatek.factorymode app versionCode=1, versionName=1 that allows unauthorized wireless settings...

CVE-2019-15421

CVE-2019-15421 affects the Blackview BV7000_Pro device (build Blackview/BV7000_Pro/BV7000_Pro:7.0/NRD90M/1493011204) due to a pre-installed, co-located app named com.mediatek.factorymode (versionCode=1, versionName=1). The vulnerability allows unauthorized wireless settings modification via a con...

CVE-2019-15420

The Blackview BV9000Pro-F Android device with a build fingerprint of Blackview/BV9000Pro-F/BV9000Pro-F:7.1.1/N4F26M/1514363110:user/release-keys contains a pre-installed app with a package name of com.mediatek.factorymode app versionCode=1, versionName=1 that allows unauthorized wireless settings...

CVE-2019-15420

CVE-2019-15420 affects Blackview BV9000Pro-F (Android 7.1.1, build Blackview/BV9000Pro-F/BV9000Pro-F:7.1.1/N4F26M/1514363110:user/release-keys). A pre-installed app com.mediatek.factorymode (version 1) enables unauthorized wireless settings modification via a confused deputy attack, accessible to...

CVE-2019-15415

The Xiaomi Redmi 5 Android device with a build fingerprint of xiaomi/vince/vince:7.1.2/N2G47H/V9.5.4.0.NEGMIFA:user/release-keys contains a pre-installed app with a package name of com.huaqin.factory app versionCode=1, versionName=QL1711201803291645 that allows unauthorized wireless settings...

CVE-2019-15415

CVE-2019-15415 concerns a pre-installed app on the Xiaomi Redmi 5 Android device (package com.huaqin.factory) that enables unauthorized modification of wireless settings through a confused-deputy attack. Impact is described as access by any co-located app with low CVSS but partial integrity impac...

CVE-2019-15394

CVE-2019-15394 concerns the Asus ZenFone 5 Selfie (ASUS_X017D_1, Android 7.1.1). A pre-installed app with package name com.asus.atd.smmitest (versionCode 1, versionName 1) enables unauthorized wireless settings modification via a confused deputy attack. This capability can be accessed by any app ...

CVE-2019-15394

The Asus ZenFone 5 Selfie Android device with a build fingerprint of asus/WWPhone/ASUSX017D1:7.1.1/NMF26F/14.0400.1810.061-20181107:user/release-keys contains a pre-installed app with a package name of com.asus.atd.smmitest app versionCode=1, versionName=1 that allows unauthorized wireless settin...

CVE-2019-15393

The Asus ZenFone Live Android device with a build fingerprint of asus/WWPhone/ASUSX00LD3:7.1.1/NMF26F/14.0400.1806.203-20180720:user/release-keys contains a pre-installed app with a package name of com.asus.atd.smmitest app versionCode=1, versionName=1 that allows unauthorized wireless settings...