Command Injection Vulnerability in Asus ZenFone AR by Asus
CVE-2019-15414

7.8HIGH

Key Information:

Vendor
Asus
Status
Zenfone Ar Firmware
Vendor
CVE Published:
14 November 2019

Summary

The Asus ZenFone AR Android device is impacted by a command injection vulnerability due to a pre-installed application, com.asus.splendidcommandagent. This app permits other pre-installed applications to execute commands through an exposed app component. Any other pre-installed app with the requisite signature or system permissions can exploit this vulnerability, enabling unauthorized access and execution of commands. This poses significant security risks if malicious apps gain access to this capability, potentially compromising user data and device integrity. Organizations and users must update their devices to mitigate potential threats.

References

https://www.kryptowire.com/android-firmware-2019/
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.