Vulnerability in Tecno Camon iClick 2 Android Device Allows Unauthorized Access

CVE-2019-15346

Summary

The Tecno Camon iClick 2 includes a pre-installed platform app that exposes an exported service allowing the execution of malicious Dalvik Executable (DEX) files. This vulnerability enables any app installed on the device to request the execution of code with system-level privileges, leading to severe privacy risks. Malicious apps can perform actions such as screen recording, factory resetting the device, accessing the user's notifications, reading logcat logs, injecting events into the graphical user interface, and retrieving sensitive user information like text messages and Wi-Fi passwords. The vulnerability arises from the inability for users to disable the vulnerable app, creating opportunities for zero-permission apps to exploit this flaw and compromise user safety.

References