Insecure App Permissions in Tecno Camon iAir 2 Plus Android Device

CVE-2019-15341

Summary

The Tecno Camon iAir 2 Plus Android device is affected by a vulnerability in a pre-installed platform app that exposes an exported service which allows any co-located application to dynamically load and execute arbitrary Dalvik Executable (DEX) files. This lax security permits malicious apps even without permissions to take control over numerous functions of the device, including screen recording, extracting notifications, accessing user messages, and altering system settings like the default input methods, significantly compromising user privacy and device integrity.

References