CVE-2019-15417

Severity Score

7.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

The Tecno Spark Pro Android device with a build fingerprint of TECNO/H3722/TECNO-K8:7.0/NRD90M/K8-H3722ABCDE-N-171229V96:user/release-keys contains a pre-installed app with a package name of com.lovelyfont.defcontainer app (versionCode=7, versionName=7.0.5) that allows unauthorized dynamic code loading via a confused deputy attack. This capability can be accessed by any app co-located on the device.

El dispositivo Tecno Spark Pro Android con una huella digital de compilación de TECNO/H3722/TECNO-K8:7.0/NRD90M/K8-H3722ABCDE-N-171229V96:user/release-keys, contiene una aplicación preinstalada con un nombre de paquete de aplicación com.lovelyfont.defcontainer (versionCode=7, versionName=7.0.5), que permite una carga de código dinámico no autorizada por medio de un ataque de tipo confused deputy. Esta capacidad puede ser accedida mediante cualquier aplicación ubicada en el dispositivo.

*Credits: N/A

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Local

Attack Complexity

Low

Authentication

None

Confidentiality

Complete

Integrity

Complete

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2019-08-22 CVE Reserved
2019-11-14 CVE Published
2023-03-08 EPSS Updated
2024-08-05 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CAPEC

References (1)

URL	Tag	Source
https://www.kryptowire.com/android-firmware-2019	Third Party Advisory

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Tecno Search vendor "Tecno"	Spark Pro Firmware Search vendor "Tecno" for product "Spark Pro Firmware"	-	-	Affected	in	Tecno Search vendor "Tecno"	Spark Pro Search vendor "Tecno" for product "Spark Pro"	-	-	Safe