VAR-202102-0137
Vulnerability from variot - Updated: 2025-01-30 22:40An issue was discovered in SeTracker2 for TK-Star Q90 Junior GPS horloge 3.1042.9.8656 devices. It has unnecessary permissions such as READ_EXTERNAL_STORAGE, WRITE_EXTERNAL_STORAGE, and READ_CONTACTS. TK-Star Q90 Junior GPS horloge For devices SeTracker2 Is vulnerable to incorrect default permissions.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state.
[Additional Information] The manifest of Q90 declares the use of permissions. However some of the declared functions are not required for proper functioning of the application. The following application permissions are not required: android.permission.SYSTEM_ALERT_WINDOW: Allows an app to create windows using the type WindowManager.LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.WRITE_EXTERNAL_STORAGE: Declaring these permissions for debugging purposes is common practice, but they should not be carried over to production releases of the app. android.permission.READ_EXTERNAL_STORAGE. android.permission.CHANGE_WIFI_STATE: Allows applications to change Wi-Fi connectivity state. android.permission.CHANGE_CONFIGURATION: Allows access to the list of accounts (including usernames) in the Accounts Service. android.permission.READ_CONTACTS: Allows an application to read the user's contacts data. android.permission.MANAGE_ACCOUNTS: The application can request create or access accounts stored locally in the AccountManager. android.permission.GET_ACCOUNTS: Allows access to the list of accounts (including usernames) in the Accounts Service. android.permission.BLUETOOTH: Allows applications to connect to paired bluetooth devices. android.permission.BLUETOOTH_ADMIN: Allows applications to discover and pair bluetooth devices. android.permission.GET_TASKS: Allows the app to retrieve information about currently and recently running tasks. This may allow the app to discover information about which applications are used on the device. The backup element (android:allowBackup) is manually set to true.
The sheer amount of unnecessary permissions, with potential high security impact, (e.g. reading all contact information, retrieving usernames, passwords and other personal information stored on the device, changing system settings, connecting to other devices) provides the application with an unnecessarily large amount of sensitive information and (potential) control over older (API 16-22) mobile devices and raises numerous questions regarding the intentions behind this application.
[Vulnerability Type] Insecure Permissions
[Vendor of Product] TK-star
[Affected Product Code Base] TK-Star Q90 Junior GPS horloge - 3.1042.9.8656
[Affected Component] Q90 SeTracker2
[Attack Type] Local
[Impact Code execution] true
[Impact Information Disclosure] true
[CVE Impact Other] Excessive permissions can enable malicious behaviour.
[Attack Vectors] to exploit the vulnerability, the application code must be updated with malicious intent.
[Has vendor confirmed or acknowledged the vulnerability?] true
[Discoverer] Dennis van Warmerdam, Jasper Nota, Jim Blankendaal
[Reference] https://www.tk-star.com
Use CVE-2019-20468
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202102-0137",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "q90 junior gps horloge",
"scope": "eq",
"trust": 1.0,
"vendor": "tk star",
"version": "3.1042.9.8656"
},
{
"model": "q90 junior gps horloge",
"scope": null,
"trust": 0.8,
"vendor": "tkstar",
"version": null
},
{
"model": "q90 junior gps horloge",
"scope": "eq",
"trust": 0.8,
"vendor": "tkstar",
"version": "q90 junior gps horloge firmware 3.1042.9.8656"
},
{
"model": "q90 junior gps horloge",
"scope": "eq",
"trust": 0.8,
"vendor": "tkstar",
"version": null
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-016204"
},
{
"db": "NVD",
"id": "CVE-2019-20468"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Willem Westerhof | Secura",
"sources": [
{
"db": "OTHER",
"id": null
}
],
"trust": 0.1
},
"cve": "CVE-2019-20468",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2019-20468",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 1.9,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"id": "CVE-2019-20468",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 9.8,
"baseSeverity": "Critical",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2019-20468",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2019-20468",
"trust": 1.0,
"value": "CRITICAL"
},
{
"author": "NVD",
"id": "CVE-2019-20468",
"trust": 0.8,
"value": "Critical"
},
{
"author": "CNNVD",
"id": "CNNVD-202102-012",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULMON",
"id": "CVE-2019-20468",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2019-20468"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-016204"
},
{
"db": "CNNVD",
"id": "CNNVD-202102-012"
},
{
"db": "NVD",
"id": "CVE-2019-20468"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "An issue was discovered in SeTracker2 for TK-Star Q90 Junior GPS horloge 3.1042.9.8656 devices. It has unnecessary permissions such as READ_EXTERNAL_STORAGE, WRITE_EXTERNAL_STORAGE, and READ_CONTACTS. TK-Star Q90 Junior GPS horloge For devices SeTracker2 Is vulnerable to incorrect default permissions.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. \n\n------------------------------------------\n\n[Additional Information]\nThe manifest of Q90 declares the use of permissions. However some of\nthe declared functions are not required for proper functioning of the\napplication. The following application permissions are not required:\nandroid.permission.SYSTEM_ALERT_WINDOW: Allows an app to create windows\nusing the type WindowManager.LayoutParams.TYPE_APPLICATION_OVERLAY,\nshown on top of all other apps. \nandroid.permission.WRITE_EXTERNAL_STORAGE: Declaring these permissions\nfor debugging purposes is common practice, but they should not be\ncarried over to production releases of the app. \nandroid.permission.READ_EXTERNAL_STORAGE. \nandroid.permission.CHANGE_WIFI_STATE: Allows applications to change\nWi-Fi connectivity state. android.permission.CHANGE_CONFIGURATION:\nAllows access to the list of accounts (including usernames) in the\nAccounts Service. android.permission.READ_CONTACTS: Allows an\napplication to read the user\u0027s contacts data. \nandroid.permission.MANAGE_ACCOUNTS: The application can request create\nor access accounts stored locally in the AccountManager. \nandroid.permission.GET_ACCOUNTS: Allows access to the list of accounts\n(including usernames) in the Accounts Service. \nandroid.permission.BLUETOOTH: Allows applications to connect to paired\nbluetooth devices. android.permission.BLUETOOTH_ADMIN: Allows\napplications to discover and pair bluetooth devices. \nandroid.permission.GET_TASKS: Allows the app to retrieve information\nabout currently and recently running tasks. This may allow the app to\ndiscover information about which applications are used on the device. \nThe backup element (android:allowBackup) is manually set to true. \n\nThe sheer amount of unnecessary permissions, with potential high\nsecurity impact, (e.g. reading all contact information, retrieving\nusernames, passwords and other personal information stored on the\ndevice, changing system settings, connecting to other devices) provides\nthe application with an unnecessarily large amount of sensitive\ninformation and (potential) control over older (API 16-22) mobile\ndevices and raises numerous questions regarding the intentions behind\nthis application. \n\n------------------------------------------\n\n[Vulnerability Type]\nInsecure Permissions\n\n------------------------------------------\n\n[Vendor of Product]\nTK-star\n\n------------------------------------------\n\n[Affected Product Code Base]\nTK-Star Q90 Junior GPS horloge - 3.1042.9.8656\n\n------------------------------------------\n\n[Affected Component]\nQ90 SeTracker2\n\n------------------------------------------\n\n[Attack Type]\nLocal\n\n------------------------------------------\n\n[Impact Code execution]\ntrue\n\n------------------------------------------\n\n[Impact Information Disclosure]\ntrue\n\n------------------------------------------\n\n[CVE Impact Other]\nExcessive permissions can enable malicious behaviour. \n\n------------------------------------------\n\n[Attack Vectors]\nto exploit the vulnerability, the application code must be updated with malicious intent. \n\n------------------------------------------\n\n[Has vendor confirmed or acknowledged the vulnerability?]\ntrue\n\n------------------------------------------\n\n[Discoverer]\nDennis van Warmerdam, Jasper Nota, Jim Blankendaal\n\n------------------------------------------\n\n[Reference]\nhttps://www.tk-star.com\n\nUse CVE-2019-20468",
"sources": [
{
"db": "NVD",
"id": "CVE-2019-20468"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-016204"
},
{
"db": "VULMON",
"id": "CVE-2019-20468"
},
{
"db": "PACKETSTORM",
"id": "179817"
}
],
"trust": 1.8
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2019-20468",
"trust": 2.7
},
{
"db": "JVNDB",
"id": "JVNDB-2019-016204",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-202102-012",
"trust": 0.6
},
{
"db": "OTHER",
"id": "NONE",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2019-20468",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "179817",
"trust": 0.1
}
],
"sources": [
{
"db": "OTHER",
"id": null
},
{
"db": "VULMON",
"id": "CVE-2019-20468"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-016204"
},
{
"db": "PACKETSTORM",
"id": "179817"
},
{
"db": "CNNVD",
"id": "CNNVD-202102-012"
},
{
"db": "NVD",
"id": "CVE-2019-20468"
}
]
},
"id": "VAR-202102-0137",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "OTHER",
"id": null
}
],
"trust": 0.01
},
"last_update_date": "2025-01-30T22:40:13.046000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top\u00a0Page",
"trust": 0.8,
"url": "https://www.tk-star.com/"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-016204"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-276",
"trust": 1.0
},
{
"problemtype": "Inappropriate default permissions (CWE-276) [NVD Evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-016204"
},
{
"db": "NVD",
"id": "CVE-2019-20468"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "https://www.eurofins-cybersecurity.com/news/connected-devices-smart-watches/"
},
{
"trust": 1.8,
"url": "https://www.tk-star.com"
},
{
"trust": 1.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-20468"
},
{
"trust": 1.0,
"url": "http://seclists.org/fulldisclosure/2024/jul/14"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/276.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2019-20468"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-016204"
},
{
"db": "PACKETSTORM",
"id": "179817"
},
{
"db": "CNNVD",
"id": "CNNVD-202102-012"
},
{
"db": "NVD",
"id": "CVE-2019-20468"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "OTHER",
"id": null
},
{
"db": "VULMON",
"id": "CVE-2019-20468"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-016204"
},
{
"db": "PACKETSTORM",
"id": "179817"
},
{
"db": "CNNVD",
"id": "CNNVD-202102-012"
},
{
"db": "NVD",
"id": "CVE-2019-20468"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2024-07-26T13:11:06",
"db": "OTHER",
"id": null
},
{
"date": "2021-02-01T00:00:00",
"db": "VULMON",
"id": "CVE-2019-20468"
},
{
"date": "2021-10-19T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2019-016204"
},
{
"date": "2024-07-30T12:35:43",
"db": "PACKETSTORM",
"id": "179817"
},
{
"date": "2021-02-01T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202102-012"
},
{
"date": "2021-02-01T21:15:13.547000",
"db": "NVD",
"id": "CVE-2019-20468"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2021-02-05T00:00:00",
"db": "VULMON",
"id": "CVE-2019-20468"
},
{
"date": "2021-10-19T07:44:00",
"db": "JVNDB",
"id": "JVNDB-2019-016204"
},
{
"date": "2021-02-09T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202102-012"
},
{
"date": "2024-11-21T04:38:33.347000",
"db": "NVD",
"id": "CVE-2019-20468"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202102-012"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "TK-Star\u00a0Q90\u00a0Junior\u00a0GPS\u00a0horloge\u00a0 For devices \u00a0SeTracker2\u00a0 Inappropriate Default Permission Vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-016204"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "other",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202102-012"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…