Vulnerability Description
The wpa_supplicant system service in Samsung Galaxy Gear series allows an unprivileged process to fully control the Wi-Fi interface, due to the lack of its D-Bus security policy configurations. This affects Tizen-based firmwares including Samsung Galaxy Gear series before build RE2.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Samsung | Galaxy Gear Firmware | < re2 |
| Samsung | Galaxy Gear | - |
| Samsung | Gear 2 Firmware | < re2 |
| Samsung | Gear 2 | - |
| Samsung | Gear Live Firmware | < re2 |
| Samsung | Gear Live | - |
| Samsung | Gear S Firmware | < re2 |
| Samsung | Gear S | - |
| Samsung | Gear S2 Firmware | < re2 |
| Samsung | Gear S2 | - |
| Samsung | Gear S3 Firmware | < re2 |
| Samsung | Gear S3 | - |
| Samsung | Gear Sport Firmware | < re2 |
| Samsung | Gear Sport | - |
| Samsung | Gear Fit Firmware | < re2 |
| Samsung | Gear Fit | - |
| Samsung | Gear Fit 2 Firmware | < re2 |
| Samsung | Gear Fit 2 | - |
| Samsung | Gear Fit 2 Pro Firmware | < re2 |
| Samsung | Gear Fit 2 Pro | - |
Related Weaknesses (CWE)
References
- https://media.defcon.org/DEF%20CON%2026/DEF%20CON%2026%20presentations/Dongsung%ExploitThird Party Advisory
- https://www.youtube.com/watch?v=3IdgBwbOT-g&feature=youtu.beExploitThird Party Advisory
- https://media.defcon.org/DEF%20CON%2026/DEF%20CON%2026%20presentations/Dongsung%ExploitThird Party Advisory
- https://www.youtube.com/watch?v=3IdgBwbOT-g&feature=youtu.beExploitThird Party Advisory
FAQ
What is CVE-2018-16272?
CVE-2018-16272 is a vulnerability with a CVSS score of 9.8 (CRITICAL). The wpa_supplicant system service in Samsung Galaxy Gear series allows an unprivileged process to fully control the Wi-Fi interface, due to the lack of its D-Bus security policy configurations. This a...
How severe is CVE-2018-16272?
CVE-2018-16272 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2018-16272?
Check the references section above for vendor advisories and patch information. Affected products include: Samsung Galaxy Gear Firmware, Samsung Galaxy Gear, Samsung Gear 2 Firmware, Samsung Gear 2, Samsung Gear Live Firmware.