Insecure App Permissions in Tecno Camon iAir 2 Plus Android Device
CVE-2019-15341

7.8HIGH

Key Information:

Vendor

Tecno-mobile

Status
Camon Iair 2\+ Firmware
Vendor
CVE Published:
14 November 2019

What is CVE-2019-15341?

The Tecno Camon iAir 2 Plus Android device is affected by a vulnerability in a pre-installed platform app that exposes an exported service which allows any co-located application to dynamically load and execute arbitrary Dalvik Executable (DEX) files. This lax security permits malicious apps even without permissions to take control over numerous functions of the device, including screen recording, extracting notifications, accessing user messages, and altering system settings like the default input methods, significantly compromising user privacy and device integrity.

References

https://www.kryptowire.com/android-firmware-2019/
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.