CVE-2019-15393
 
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
The Asus ZenFone Live Android device with a build fingerprint of asus/WW_Phone/ASUS_X00LD_3:7.1.1/NMF26F/14.0400.1806.203-20180720:user/release-keys contains a pre-installed app with a package name of com.asus.atd.smmitest app (versionCode=1, versionName=1) that allows unauthorized wireless settings modification via a confused deputy attack. This capability can be accessed by any app co-located on the device.
El dispositivo Asus ZenFone Live Android con una huella digital de asus/WW_Phone/ASUS_X00LD_3:7.1.1/NMF26F/14.0400.1806.203-20180720:user/release-keys, contiene una aplicación preinstalada con un nombre de paquete de aplicación com.asus.atd.smmitest (versionCode=1, versionName=1), que permite la modificación de la configuración inalámbrica no autorizada por medio de un ataque de tipo confused deputy. Esta capacidad puede ser accedida mediante cualquier aplicación ubicada en el dispositivo
CVSS Scores
SSVC
- Decision:-
Timeline
- 2019-08-22 CVE Reserved
- 2019-11-14 CVE Published
- 2023-03-08 EPSS Updated
- 2024-08-05 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-610: Externally Controlled Reference to a Resource in Another Sphere
CAPEC
References (1)
URL | Tag | Source |
---|---|---|
https://www.kryptowire.com/android-firmware-2019 | Third Party Advisory |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Asus Search vendor "Asus" | Zenfone Live \(l1\) Firmware Search vendor "Asus" for product "Zenfone Live \(l1\) Firmware" | - | - |
Affected
| in | Asus Search vendor "Asus" | Zenfone Live \(l1\) Search vendor "Asus" for product "Zenfone Live \(l1\)" | - | - |
Safe
|