Command Execution Vulnerability in Asus Android Device
CVE-2019-15401

7.8HIGH

Key Information:

Vendor
Asus
Status
Zenfone Ar Firmware
Vendor
CVE Published:
14 November 2019

Summary

The Asus ASUS_A002 Android device contains a pre-installed application that exposes a significant security risk by allowing unauthorized command execution. Specifically, the app, identified as com.asus.loguploaderproxy, can be exploited by any other pre-installed application with sufficient permissions. This vulnerability arises from the export of app component capabilities, enabling malicious pre-installed apps to perform actions unexpectedly on behalf of users. It highlights the importance of app isolation and stringent permissions for maintaining device security.

References

https://www.kryptowire.com/android-firmware-2019/
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.