CVE-2019-6741

6.5MEDIUM

Key Information:

Vendor
Samsung
Status
Galaxy S9
Vendor
CVE Published:
3 June 2019

Summary

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samsung Galaxy S9 prior to January 2019 Security Update (SMR-JAN-2019 - SVE-2018-13467). User interaction is required to exploit this vulnerability in that the target must connect to a wireless network. The specific flaw exists within the captive portal. By manipulating HTML, an attacker can force a page redirection. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7476.

Affected Version(s)

Galaxy S9 prior to January 2019 Security Update (SMR-JAN-2019 - SVE-2018-13467)

References

https://www.zerodayinitiative.com/advisories/ZDI-19-254/
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

MWR Labs - Georgi Geshev and Robert Miller
.