CVE-2019-15430 — MEDIUM (5.5)

Vulnerability Description

The Bluboo D3 Pro Android device with a build fingerprint of BLUBOO/Bluboo_D2_Pro/Bluboo_D2_Pro:7.0/NRD90M/1510370501:user/release-keys contains a pre-installed app with a package name of com.qiku.cleaner app (versionCode=2, versionName=2.0.0_VER_32516508295515) that allows other pre-installed apps to perform system properties modification via an accessible app component. This capability can be accessed by any pre-installed app on the device which can obtain signatureOrSystem permissions that are required by other other pre-installed apps that exported their capabilities to other pre-installed app.

CVSS Score

5.5

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

HIGH

Availability

NONE

Affected Products

Vendor	Product	Versions
Bluboo D3 Pro Project	Bluboo D3 Pro Firmware	-
Bluboo D3 Pro Project	Bluboo D3 Pro	-

References

https://www.kryptowire.com/android-firmware-2019/Third Party Advisory
https://www.kryptowire.com/android-firmware-2019/Third Party Advisory

FAQ

What is CVE-2019-15430?

CVE-2019-15430 is a vulnerability with a CVSS score of 5.5 (MEDIUM). The Bluboo D3 Pro Android device with a build fingerprint of BLUBOO/Bluboo_D2_Pro/Bluboo_D2_Pro:7.0/NRD90M/1510370501:user/release-keys contains a pre-installed app with a package name of com.qiku.cle...

How severe is CVE-2019-15430?

CVE-2019-15430 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2019-15430?

Check the references section above for vendor advisories and patch information. Affected products include: Bluboo D3 Pro Project Bluboo D3 Pro Firmware, Bluboo D3 Pro Project Bluboo D3 Pro.