PT-2019-14122

CVE-2019-15393

·

Published

2019-11-14

·

Updated

2019-11-27

Description by

CVSS 2.0
2.1
Low
MetricsAV:L/AC:L/Au:N/C:N/I:P/A:N
Name of the Vulnerable Software and Affected Versions Asus ZenFone Live Android device with a build fingerprint of asus/WW Phone/ASUS X00LD 3:7.1.1/NMF26F/14.0400.1806.203-20180720:user/release-keys
Description The issue allows unauthorized modification of wireless settings via a confused deputy attack. This capability can be accessed by any app co-located on the device, specifically through the pre-installed app with a package name of com.asus.atd.smmitest app.
Recommendations For the Asus ZenFone Live Android device with the specified build fingerprint, consider removing or disabling the com.asus.atd.smmitest app to prevent unauthorized wireless settings modification until a patch is available.
Exploitability
Fix
Vendors
Affected products
Weakness enumeration
CWE-610: Externally Controlled Reference to a Resource in Another Sphere
Related identifiers
CVE-2019-15393
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com