Vulnerability-Lookup

CNVD-2020-14802

Vulnerability from cnvd - Published: 2020-03-01

Title

Tecno Camon存在未明漏洞（CNVD-2020-14802）

Description

传音 Tecno Camon是中国传音公司的一款Camon系列智能手机。 Tecno Camon存在未明漏洞。攻击者可利用该漏洞以系统权限执行代码或命令，进而进行录屏，恢复出厂设置，获取用户Wi-Fi密码，读取logcat日志，向GUI注入事件或修改默认的Input Method Editor，获取用户通知及短信消息等。

Severity

高

Formal description

厂商尚未提供漏洞修复方案，请关注厂商主页更新： https://www.tecno-mobile.com/

Reference

https://nvd.nist.gov/vuln/detail/CVE-2019-15349

Impacted products

Name
Tecno Camon

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2019-15349",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2019-15349"
    }
  },
  "description": "\u4f20\u97f3 Tecno Camon\u662f\u4e2d\u56fd\u4f20\u97f3\u516c\u53f8\u7684\u4e00\u6b3eCamon\u7cfb\u5217\u667a\u80fd\u624b\u673a\u3002\n\nTecno Camon\u5b58\u5728\u672a\u660e\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u4ee5\u7cfb\u7edf\u6743\u9650\u6267\u884c\u4ee3\u7801\u6216\u547d\u4ee4\uff0c\u8fdb\u800c\u8fdb\u884c\u5f55\u5c4f\uff0c\u6062\u590d\u51fa\u5382\u8bbe\u7f6e\uff0c\u83b7\u53d6\u7528\u6237Wi-Fi\u5bc6\u7801\uff0c\u8bfb\u53d6logcat\u65e5\u5fd7\uff0c\u5411GUI\u6ce8\u5165\u4e8b\u4ef6\u6216\u4fee\u6539\u9ed8\u8ba4\u7684Input Method Editor\uff0c\u83b7\u53d6\u7528\u6237\u901a\u77e5\u53ca\u77ed\u4fe1\u6d88\u606f\u7b49\u3002",
  "formalWay": "\u5382\u5546\u5c1a\u672a\u63d0\u4f9b\u6f0f\u6d1e\u4fee\u590d\u65b9\u6848\uff0c\u8bf7\u5173\u6ce8\u5382\u5546\u4e3b\u9875\u66f4\u65b0\uff1a\r\nhttps://www.tecno-mobile.com/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2020-14802",
  "openTime": "2020-03-01",
  "products": {
    "product": "Tecno Camon"
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2019-15349",
  "serverity": "\u9ad8",
  "submitTime": "2019-12-17",
  "title": "Tecno Camon\u5b58\u5728\u672a\u660e\u6f0f\u6d1e\uff08CNVD-2020-14802\uff09"
}

CVE-2019-15349 (GCVE-0-2019-15349)

Vulnerability from cvelistv5 – Published: 2019-11-14 16:24 – Updated: 2024-08-05 00:42

Summary

The Tecno Camon Android device with a build fingerprint of TECNO/H612/TECNO-ID5a:8.1.0/O11019/F-180828V106:user/release-keys contains a pre-installed platform app with a package name of com.lovelyfont.defcontainer (versionCode=7, versionName=7.0.11). This app contains an exported service named com.lovelyfont.manager.service.FunctionService that allows any app co-located on the device to supply the file path to a Dalvik Executable (DEX) file which it will dynamically load within its own process and execute in with its own system privileges. This app cannot be disabled by the user and the attack can be performed by a zero-permission app. Executing commands as the system user can allow a third-party app to video record the user's screen, factory reset the device, obtain the user's notifications, read the logcat logs, inject events in the Graphical User Interface (GUI), and obtains the user's text messages, and more. Executing code as the system user can allow a third-party app to factory reset the device, obtain the user's Wi-Fi passwords, obtain the user's notifications, read the logcat logs, inject events in the GUI, change the default Input Method Editor (IME) (e.g., keyboard) with one contained within the attacking app that contains keylogging functionality, and obtains the user's text messages, and more.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

1 reference

URL	Tags
https://www.kryptowire.com/android-firmware-2019/	x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T00:42:03.800Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.kryptowire.com/android-firmware-2019/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Tecno Camon Android device with a build fingerprint of TECNO/H612/TECNO-ID5a:8.1.0/O11019/F-180828V106:user/release-keys contains a pre-installed platform app with a package name of com.lovelyfont.defcontainer (versionCode=7, versionName=7.0.11). This app contains an exported service named com.lovelyfont.manager.service.FunctionService that allows any app co-located on the device to supply the file path to a Dalvik Executable (DEX) file which it will dynamically load within its own process and execute in with its own system privileges. This app cannot be disabled by the user and the attack can be performed by a zero-permission app. Executing commands as the system user can allow a third-party app to video record the user\u0027s screen, factory reset the device, obtain the user\u0027s notifications, read the logcat logs, inject events in the Graphical User Interface (GUI), and obtains the user\u0027s text messages, and more. Executing code as the system user can allow a third-party app to factory reset the device, obtain the user\u0027s Wi-Fi passwords, obtain the user\u0027s notifications, read the logcat logs, inject events in the GUI, change the default Input Method Editor (IME) (e.g., keyboard) with one contained within the attacking app that contains keylogging functionality, and obtains the user\u0027s text messages, and more."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-11-14T16:24:48.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.kryptowire.com/android-firmware-2019/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2019-15349",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Tecno Camon Android device with a build fingerprint of TECNO/H612/TECNO-ID5a:8.1.0/O11019/F-180828V106:user/release-keys contains a pre-installed platform app with a package name of com.lovelyfont.defcontainer (versionCode=7, versionName=7.0.11). This app contains an exported service named com.lovelyfont.manager.service.FunctionService that allows any app co-located on the device to supply the file path to a Dalvik Executable (DEX) file which it will dynamically load within its own process and execute in with its own system privileges. This app cannot be disabled by the user and the attack can be performed by a zero-permission app. Executing commands as the system user can allow a third-party app to video record the user\u0027s screen, factory reset the device, obtain the user\u0027s notifications, read the logcat logs, inject events in the Graphical User Interface (GUI), and obtains the user\u0027s text messages, and more. Executing code as the system user can allow a third-party app to factory reset the device, obtain the user\u0027s Wi-Fi passwords, obtain the user\u0027s notifications, read the logcat logs, inject events in the GUI, change the default Input Method Editor (IME) (e.g., keyboard) with one contained within the attacking app that contains keylogging functionality, and obtains the user\u0027s text messages, and more."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.kryptowire.com/android-firmware-2019/",
              "refsource": "MISC",
              "url": "https://www.kryptowire.com/android-firmware-2019/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2019-15349",
    "datePublished": "2019-11-14T16:24:48.000Z",
    "dateReserved": "2019-08-22T00:00:00.000Z",
    "dateUpdated": "2024-08-05T00:42:03.800Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.