Android Device Vulnerability in Tecno Camon iClick by Tecno

CVE-2019-15345

Summary

The Tecno Camon iClick features a critical vulnerability due to an exported service within a pre-installed app that allows any co-located application to dynamically load and execute a Dalvik Executable (DEX) file with system-level permissions. This weakness can be exploited by unprivileged applications, enabling them to perform a wide array of malicious activities such as video recording the screen, factory resetting the device, accessing sensitive notifications, reading log files, and intercepting personal messages. The downside of this vulnerability is that the pre-installed app cannot be disabled by users, significantly increasing the risk of unauthorized monitoring and control over the device.

References