Android Device Vulnerability in Tecno Camon with Pre-installed App by Tecno

CVE-2019-15351

Summary

A vulnerability exists in Tecno's Android devices where a pre-installed app grants malicious applications the ability to execute arbitrary commands as the system user. This is achieved through an exported service that reacts to manipulated log messages. The implications of this flaw are severe, as it allows attackers to perform actions such as screen recording, factory resets, accessing notifications, altering the graphical user interface, and reading sensitive user messages. The compromised app cannot be disabled by users, and the exploit can be triggered by apps with no special permissions.

References